CVE-2025-67850
HIGHmoodle < 4.1.22 - Stored Cross-Site Scripting in Formula Editor Arithmetic Expression Fields
Title source: llmDescription
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
References (2)
Core 2
Core References
Third Party Advisory vdb-entry
x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-67850
Issue Tracking, Third Party Advisory issue-tracking
x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2423838
Scores
CVSS v3
7.3
EPSS
0.0001
EPSS Percentile
1.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-79
Status
published
Products (3)
moodle/moodle
5.1.0
moodle/moodle
< 4.1.22
moodle/moodle
0 - 4.1.22Packagist
Published
Feb 03, 2026
Tracked Since
Feb 18, 2026