Description

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

Remediation

References

CVE-2019-3810

Related Vulnerabilities

WordPress Plugin One User Avatar-User Profile Picture Multiple Vulnerabilities (2.3.6)

Liferay Portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-29053)

Oracle Database Server CVE-2009-1973 Vulnerability (CVE-2009-1973)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36401)

SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2025-30384)

Severity

Medium

Classification

CVE-2019-3810 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities