CVE-2025-60507

Cross site scripting vulnerability in Moodle GeniAI plugin localgeniai 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users including Students or...

PT-2025-42919

Name of the Vulnerable Software and Affected Versions Moodle GeniAI plugin local geniai version 2.3.6 Description A cross-site scripting issue exists in the Moodle GeniAI plugin local geniai. An authenticated user with Teacher role can upload a PDF file containing embedded JavaScript. The plugin...

CVE-2025-60507

CVE-2025-60507 describes a cross-site scripting vulnerability in Moodle GeniAI plugin (local_geniai) version 2.3.6. An authenticated user with the Teacher role can upload a PDF containing embedded JavaScript. The system outputs a direct HTML link to the uploaded file without sanitization, enablin...