MSA-25-0053: XSS risk via AI prompt injection

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2025-12-15 12:19 UTC
Importiert: 2026-06-07 08:02 UTC
CVSS: 7.3
Quelle-ID: moodle
uid_hash: a2c5eff1e5717a4d30e8e66e8ea11c19ffc3c856d875efaec859cdefeb99a8ff

Moodle Security Announcements

by Michael Hawkins.

Insufficient sanitizing of AI provider responses resulted in an XSS risk.

Severity/Risk: Serious

Versions affected: 5.1, 5.0 to 5.0.3 and 4.5 to 4.5.7

Versions fixed: 5.1.1, 5.0.4 and 4.5.8

Reported by: Vuln37

CVE identifier: CVE-2025-67849

Tracker issue: MDL-87267 XSS risk via AI prompt injection

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2025-67849	HIGH	7.3	HIGH	7.3			2026-02-03

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Moodle Security Announcements	moodle	vendor_advisory	cms	-	de	https://moodle.org/rss/file.php/154821/7ef1adaa0762dfdd7cd390868b6d9f2b/mod_forum/996/rss.xml