CVE-2025-67855

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

5.4

EPSS

0.33%

Published

Feb 3, 2026

Modified

Feb 11, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerability arises from insufficient sanitization of URL parameters, allowing attackers to inject malicious scripts through specially crafted links. Successful exploitation could lead to information disclosure or arbitrary client-side script execution within the user's browser.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (5)

moodle · moodle (up to 4.1.22)vulnerable

moodle · moodle (up to 4.4.11)vulnerable

moodle · moodle (up to 4.5.8)vulnerable

moodle · moodle (up to 5.0.4)vulnerable

moodle · moodlevulnerable

References (2)

https://access.redhat.com/security/cve/CVE-2025-67855

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2423861

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs