Cross Site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute malicious script in a user's browser via Text-based feedback answers...

CVE-2021-20280: Improper Neutralization of Input During Web Page Generation

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...