Cross-Site Scripting (XSS)

moodle/moodle is vulnerable to cross-site scripting (XSS). An attacker is able to inject arbitrary Javascript into another user’s browsing context via a malicious dashboard script. Users with the login as other users functionality are affected by this vulnerability when they access an attacker’s dashboard, which causes the malicious script to be executed in the user’s browser.