Moodle LMS 4.0 Cross Site Scripting

Exploit Title: Moodle LMS 4.0 - Cross-Site Scripting XSS Date: 26/10/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://moodle.org/ Software Link: https://git.in.moodle.com/moodle Version: 4.0 Tested on: XAMPP, Windows 10 Contact: https://twitter.com/dmaral3noz Description: A Cross Site...

CVE-2023-28333

The Mustache pix helper contained a potential Mustache injection risk if combined with user input note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS...

CVE-2023-28333

The Mustache pix helper contained a potential Mustache injection risk if combined with user input note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS...

Code injection

The Mustache pix helper contained a potential Mustache injection risk if combined with user input note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS...

CVE-2023-28333

CVE-2023-28333 describes a potential injection risk in Moodle’s Mustache pix helper when combined with user input. The description notes this did not appear to be implemented or exploitable in the core Moodle LMS. Connected documents corroborate exposure across multiple Moodle versions (3.11–4.2 ...

CVE-2023-0844

The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0844

The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0844 Namaste! LMS < 2.6 - Admin+ Stored XSS

The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0844 Namaste! LMS < 2.6 - Admin+ Stored XSS

The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0844

CVE-2023-0844 affects Namaste! LMS WordPress plugin prior to 2.6. The issue is a Stored XSS vulnerability caused by insufficient sanitization/escaping of plugin settings, allowing high-privilege users (e.g., admins) to inject script even when unfiltered_html is disallowed (e.g., multisite). Accor...

PT-2023-16562 · WordPress · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS WordPress plugin versions prior to 2.6 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

WordPress Namaste! LMS Plugin < 2.6 is vulnerable to Cross Site Scripting (XSS)

Software Namaste! LMS Type Plugin Vulnerable versions 2.6 Fixed in 2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0844 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5f40301e0581 Credits Alex Sanford Required privilege...

WordPress Namaste! LMS Plugin < 2.5.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Namaste! LMS Type Plugin Vulnerable versions 2.5.9.4 Fixed in 2.5.9.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0548 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2cc963427a7a Credits Felipe Restrepo Rodriguez...

CVE-2023-0548

The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0548 Namaste! LMS < 2.5.9.4 - Admin+ Stored XSS

The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0548 Namaste! LMS < 2.5.9.4 - Admin+ Stored XSS

The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0548

The Namaste! LMS WordPress plugin is affected in versions before 2.5.9.4. The issue arises because the plugin does not fully sanitize/escape certain settings, enabling Stored XSS for high-privilege users (e.g., Administrators) even when unfiltered_html is disallowed (including multisite setups). ...

WordPress Plugin Namaste! LMS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...