-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient input sanitization in the module editing workflow. While client-side filtering exists via TinyMCE editor, the server-side processing in modedit.php's update_moduleinfo function accepts raw HTML input from introeditor[text] parameter and stores it without proper neutralization. This allows authenticated teachers to persist arbitrary JavaScript that executes when other users view the course module. The file path and function are explicitly tied to the vulnerable endpoint described in CVE/GHSA documentation, and the attack vector matches the described parameter injection pattern.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.7, <= 3.7.2 |