CVE-2026-102586: falha de média gravidade em moodle
Moodle: xss via password reset link due to insufficient username escaping
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
probabilidade de exploração
0.3%top 82% das CVEs
exploração observada
nãonenhuma fonte reporta
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
moodleCVEs relacionadas — moodle
No mesmo produto, das mais perigosas para as menos.
CVE-2024-43425HIGHMoodle: remote code execution via calculated question typesEPSS 87.5%CVE-2023-30943MEDIUMMoodle: tinymce loaders susceptible to arbitrary folder creationEPSS 6.6%CVE-2026-26046HIGHMoodle: moodle: improper input sanitization in tex filter administration settingEPSS 3.0%CVE-2023-5540MEDIUMMoodle: authenticated remote code execution risk in imscpEPSS 1.9%CVE-2023-5539MEDIUMMoodle: authenticated remote code execution risk in lessonEPSS 1.9%CVE-2023-5550MEDIUMMoodle: rce due to lfi risk in some misconfigured shared hosting environmentsEPSS 1.4%