Description
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
Remediation
References
Related Vulnerabilities
WebLogic CVE-2017-10148 Vulnerability (CVE-2017-10148)
WebLogic CVE-2019-2658 Vulnerability (CVE-2019-2658)
WordPress Plugin YITH PayPal Express Checkout for WooCommerce Security Bypass (1.2.5)
SharePoint CVE-2021-34519 Vulnerability (CVE-2021-34519)
WordPress Plugin Product Reviews Import Export for WooCommerce Cross-Site Request Forgery (1.3.2)