Description

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.

Remediation

References

CVE-2018-10891

Related Vulnerabilities

WordPress Plugin MP3-jPlayer Cross-Site Scripting (1.8.3)

MySQL CVE-2015-4895 Vulnerability (CVE-2015-4895)

WordPress Plugin stm-megamenu Local File Inclusion (2.3.12)

WebLogic CVE-2023-21931 Vulnerability (CVE-2023-21931)

Drupal Core 9.2.x Cross-Site Request Forgery (9.2.0 - 9.2.5)

Severity

High

Classification

CVE-2018-10891 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities