Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. Authenticated attackers can inject web script and HTML into the application through the externalformattext function in lib/externallib.php...