CVE-2024-31026

Received Received - Intake

Arbitrary Code Execution in GUnet Open eClass Platform

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: MITRE

Description

An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2024-31026

EUVD

EUVD-2024-55775

Affected Vendors & Products

Vendor	Product	Version / Range
greek_universities_network	open_eclass_platform	3.15
gunet	open_eclass	to 3.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2024-31026 is an HTML injection vulnerability in GUnet Open eClass versions 3.15 and earlier. It allows attackers to inject malicious code through the chat input field in any course module, potentially enabling phishing attacks or malware distribution.

Detection Guidance

Check for unauthorized HTML or JavaScript code in the chat input field of course modules in GUnet Open eClass v3.15 or earlier. Inspect network traffic for unexpected redirects or malicious payloads from the modules/chat/ directory.

Impact Analysis

This vulnerability could allow attackers to deceive users by injecting fake content, redirect them to harmful websites, or trick them into downloading malware. Users interacting with the chat feature in affected courses may unknowingly expose themselves to these risks.

Mitigation Strategies

Update GUnet Open eClass to a version beyond 3.15. If updating is not possible, implement input validation to escape or strip HTML tags in the chat input field or use a whitelist sanitizer to render chat content safely.

Hi! I’m here to help you understand CVE-2024-31026. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70