CVE-2025-26528lowCWE-79

CVE-2025-26528: falha de baixa gravidade em moodle

Stored XSS in ddimageortext question type

Publicada em

Seguir esta CVE+ Monitorar moodle+ Monitorar moodle/moodle

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.4epss 0.3%
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
Produtos afetados
Moodle Project · moodle
CVEs relacionadas — moodle

No mesmo produto, das mais perigosas para as menos.

CVE-2025-26533HIGHSQL injection risk in course search module list filterEPSS 0.6%CVE-2025-26529HIGHStored XSS risk in admin live logEPSS 0.5%CVE-2025-26525HIGHArbitrary file read risk through pdfTeXEPSS 0.4%CVE-2026-119553HIGHMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path TraversalEPSS 0.4%CVE-2025-26527MEDIUMNon-searchable tags can still be discovered on the tag search page and in the tags blockEPSS 0.4%CVE-2025-26530HIGHReflected XSS via question bank filterEPSS 0.4%