Is this vulnerability remotely exploitable over the internet?

Yes, if the Open eClass instance is reachable over the internet and student accounts can be created or accessed remotely, an attacker can exploit the issue simply by submitting crafted assignments and waiting for an instructor to view them.

Does an attacker need elevated privileges to exploit this?

No elevated privileges are required beyond a standard student role with permission to submit assignments. The attack targets instructors or other higher-privileged users who review those submissions.

What is the safest general fix pattern for this issue?

The most robust fix pattern is to treat all student-supplied data as untrusted and apply context-aware output encoding or sanitization before rendering it in instructor views, ideally through centralized template helpers or sanitization APIs rather than ad hoc filtering.

Severity:

HIGH RISK

(8.7)

Stored Cross-Site Scripting (CWE-79) in Open eClass Assignment Submissions

CVE-2026-24665

Published:

Feb 3, 2026

Status:

Analyzed

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

NDV

Recent Vulnerabilities

CWE-306

CRITICAL RISK

CRITICAL

(9.8)

Missing Authentication for Forgot-Password Email Change API (CWE-306)

Account Takeover / Loss of Account Control

February 17, 2026

CWE-77;CWE-78

HIGH RISK

HIGH

(7.3)

OS Command Injection (CWE-78) in node-sonos-http-api TTS Provider for macOS

Remote Code Execution on the Server Host

February 17, 2026

Vulnerability Type

Category:

Cross-Site Scripting (XSS)

CWE:

CWE-79

Impact:

Stored Cross-Site Scripting leading to instructor session compromise and privilege abuse

Severity:

HIGH RISK

(8.7)

CVSS Version:

3.1

Vulnerability Type

Category:

Cross-Site Scripting (XSS)

CWE:

CWE-79

Impact:

Stored Cross-Site Scripting leading to instructor session compromise and privilege abuse

Severity:

HIGH RISK

(8.7)

CVSS Version:

3.1

Catch This CVE While Code Is Being Written

Detect vulnerable code directly in pull requests, so CVEs are fixed before merge.

Get Started

Ship clean & secure code faster

START 14 DAYS FREE TRIAL

BOOK A DEMO

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Stored Cross-Site Scripting (CWE-79) in Open eClass Assignment Submissions

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

Recent Vulnerabilities

CRITICAL RISK

CRITICAL

(9.8)

Missing Authentication for Forgot-Password Email Change API (CWE-306)

HIGH RISK

HIGH

(7.3)

OS Command Injection (CWE-78) in node-sonos-http-api TTS Provider for macOS

Vulnerability Type

Vulnerability Type

Vulnerability Type

Vulnerability Type

Catch This CVE While Code Is Being Written

Ship clean & secure code faster

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare