Description

Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.

Remediation

References

CVE-2015-3178

Related Vulnerabilities

WordPress Plugin WCFM-Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible SQL Injection (6.5.11)

WordPress Plugin Contact Form to DB by BestWebSoft-Messages Database For WordPress SQL Injection (1.7.1)

PHP Other Vulnerability (CVE-2015-4644)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1130)

YetiForce CRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-2885)

Severity

Low

Classification

CVE-2015-3178 CWE-707

Tags

Missing Update Known Vulnerabilities