CVE-2025-65734

low-risk

Published 2026-03-16

An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to execute arbitrary code via uploading a crafted SVG file.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Openeclass

Affected Vendors

Openeclass

References (4)

Not Applicable https://github.com/apostolides

Exploit https://huntr.com/bounties/540f743c-fa3e-4be6-9f85-439fff2fc5fe

Third Party Advisory https://huntr.com/users/apostolides

Not Applicable https://www.linkedin.com/in/thanos-apostolidis-3255591b1/

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal