CVE-2025-67849

6.1 mediumEPSS 0.3%

Medium (6.1) in moodle moodle. EPSS 0.3% chance of exploitation in the next 30 days.

A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-02-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

moodle:moodle

References

https://access.redhat.com/security/cve/CVE-2025-67849
https://bugzilla.redhat.com/show_bug.cgi?id=2423835

Check your stack JSON