The vulnerability stems from improper validation of the 'currentorg' parameter in mod/scorm/player.php and mod/scorm/prereqs.php. The commit patches show that these files previously used PARAM_RAW for 'currentorg' without checking if the value was a valid organization identifier in the database. This allowed attackers to inject arbitrary HTML/JavaScript via the parameter. The added validation in the patch (checking scorm_scoes) confirms the root cause. While the code resides in the global scope of the scripts (not specific named functions), the parameter handling logic in these files is the vulnerable entry point.