CVE-2023-5546 Moodle: stored xss in quiz grading report via user id number

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

CVE-2023-5546

CVE-2023-5546 concerns Moodle: stored cross-site scripting via quiz grading report, triggered by displaying user-id numbers without adequate sanitization. The connected sources consistently describe this as a Moodle-related vulnerability where the risk is a stored XSS, arising from insufficient i...

CVE-2023-5546 Moodle: stored xss in quiz grading report via user id number

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

CVE-2023-5546

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

CVE-2023-5546: Improper Neutralization of Input During Web Page Generation

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

PT-2023-32168 · Moodle +8 · Moodle +3

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue concerns a stored XSS risk in the quiz grading report, where ID numbers were not properly sanitized. This could potentially allow for malicious script execution. Recommendations:...

Hacking the High School Grading System

Interesting New York Times article about high-school students hacking the grading system. Whats not helping? The policies many school districts are adopting that make it nearly impossible for low-performing students to fail--they have a grading floor under them, they know it, and that allows them...

SUSE CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

Autolab path traversal vulnerability

Autolab is a course management service. Autolab supports automatic grading of programming assignments. a path traversal vulnerability exists in Autolab. An attacker could exploit this vulnerability to view the contents of a file...

Autolab OS Command Injection Vulnerability

Autolab is a course management service. Autolab supports automated grading of programming assignments. an operating system command injection vulnerability exists in Autolab. An attacker could exploit this vulnerability to execute code on the hosted Autolab server...

CVE-2021-31650

A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter...

CVE-2021-31650

A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter...

Sql injection

A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter...

CVE-2021-31650

CVE-2021-31650 affects Sourcecodester Online Grading System 1.0 with a SQL injection in the uname parameter, enabling remote attackers to execute arbitrary SQL commands. The vulnerability is rated CVSS v3.1 at 9.8 (CRITICAL). Public exploit availability is indicated (Exploit-DB). No patch/version...

Online Grading System SQL注入漏洞

Sourcecodester Online Grading System is a student information management system. The system provides functions such as student information management and online grading. A security vulnerability exists in Online Grading System version 1.0, which is caused by a uname parameter that allows remote...

CVE-2021-31650

A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter...

CVE-2021-31650: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter...

PT-2022-10042 · Unknown · Sourcecodester Online Grading System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Grading System version 1.0 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the uname parameter. Recommendations: For Sourcecodester Online Grading System version 1.0,...

Moodle multiple cross-site request forgery (CSRF) vulnerabilities

Multiple cross-site request forgery CSRF vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of teachers for quick-grading requests...

Moodle does not set the RISK_XSS bit for graders

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...