SUSE CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

Cross-Site Scripting (XSS)

Moodle is vulnerable to cross-site scriptingXSS attacks. The attacks are possible because the application does not use the RISKXSS flag in mod/quiz/db/access.php, allowing attackers to use this loophole when providing gradebook feedback for manual quiz grading...

UBUNTU-CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

PT-2015-1573

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.9 and earlier, 2.6.x before 2.6.11, 2.7.x before 2.7.8, 2.8.x before 2.8.6 Description The issue allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual qui...