Description
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
Remediation
References
Related Vulnerabilities
WordPress Plugin Social LikeBox & Feed Cross-Site Scripting (2.8.4)
MySQL CVE-2016-0655 Vulnerability (CVE-2016-0655)
PostgreSQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-32028)
WordPress Plugin My Calendar Multiple Cross-Site Scripting Vulnerabilities (2.3.9)
WordPress Plugin Contact Bank-Contact Form Builder for WordPress Cross-Site Scripting (2.0.69)