Description

Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field.

Remediation

References

CVE-2016-2152

Related Vulnerabilities

Drupal Core 5.x Arbitrary Code Execution (5.0 - 5.2)

WordPress Plugin Ditty WordPress-Responsive Slider, List, and Ticker Display Unspecified Vulnerability (1.5.1)

Python Cryptographic Issues Vulnerability (CVE-2013-7040)

WordPress Plugin Awesome Support-WordPress HelpDesk & Support Unspecified Vulnerability (6.0.7)

osTicket Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-45811)

Severity

Medium

Classification

CVE-2016-2152 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities