CVE-2025-60506

Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting XSS via the Public Comments feature. An attacker with a low-privileged account e.g., Student can inject arbitrary JavaScript payloads into a comment. When any other user Student, Teacher, or Admin views the annotated PD...

Moodle PDF Annotator plugin 安全漏洞

Moodle PDF Annotator plugin is an open source teaching plugin for Moodle. A security vulnerability exists in Moodle PDF Annotator plugin version 1.5 release 9, which stems from the public comments feature not properly filtering input and could lead to a stored cross-site scripting attack...

CVE-2025-60506

The Moodle PDF Annotator plugin v1.5 release 9 is vulnerable to stored cross-site scripting (XSS) due to improper filtering of input within the Public Comments feature. A low-privileged user, such as a Student , can inject arbitrary JavaScript payloads into a comment. When other users, including ...