CVE-2025-67849

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N                                    

Vulnerability Description

A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.

Vulnerability Details

Published Date

February 03, 2026

Last Modified

February 04, 2026

CWE ID

CWE-79

Source

NVD

Vendor

composer

Product

moodle/moodle

External References

https://access.redhat.com/security/cve/CVE-2025-67849
https://bugzilla.redhat.com/show_bug.cgi?id=2423835

CVE-2025-67849

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment