Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-ewey-azre-s3fh
Summary
Moodle Cross-site Scripting (XSS) vulnerability
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
Aliases
0
alias CVE-2025-67849
1
alias GHSA-mhf6-pp52-8wqj
Fixed_packages
0
url pkg:composer/moodle/moodle@4.1.22
purl pkg:composer/moodle/moodle@4.1.22
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@4.1.22
1
url pkg:composer/moodle/moodle@4.4.12
purl pkg:composer/moodle/moodle@4.4.12
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@4.4.12
2
url pkg:composer/moodle/moodle@4.5.8
purl pkg:composer/moodle/moodle@4.5.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@4.5.8
3
url pkg:composer/moodle/moodle@5.0.4
purl pkg:composer/moodle/moodle@5.0.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@5.0.4
4
url pkg:composer/moodle/moodle@5.1.1
purl pkg:composer/moodle/moodle@5.1.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@5.1.1
Affected_packages
0
url pkg:composer/moodle/moodle@4.4.0-beta
purl pkg:composer/moodle/moodle@4.4.0-beta
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1vuz-a4xt-5qd4
1
vulnerability VCID-4rt1-tzwg-4kgg
2
vulnerability VCID-4uwn-m5xb-8ufn
3
vulnerability VCID-595g-p5gs-8fdf
4
vulnerability VCID-5gaz-3z56-z7h6
5
vulnerability VCID-5j8c-enhg-2kgw
6
vulnerability VCID-5pak-k74c-6fda
7
vulnerability VCID-5wd4-h2bh-vyh9
8
vulnerability VCID-7f2q-hz7t-tkdx
9
vulnerability VCID-7r7p-pcsy-ubbj
10
vulnerability VCID-7xms-9t2c-vbbv
11
vulnerability VCID-7z2w-xpn7-gbhm
12
vulnerability VCID-9put-kp7s-ybae
13
vulnerability VCID-aa5b-kczd-a7cz
14
vulnerability VCID-aac8-q8g6-ebfw
15
vulnerability VCID-au2d-mwnn-rkau
16
vulnerability VCID-cf3k-pt7y-d3c9
17
vulnerability VCID-d19b-f2vj-fqg7
18
vulnerability VCID-d2nv-u78g-wfab
19
vulnerability VCID-dd69-413v-qqhf
20
vulnerability VCID-eutz-ecg4-b3he
21
vulnerability VCID-evtb-ua7c-3fed
22
vulnerability VCID-ewey-azre-s3fh
23
vulnerability VCID-ftn9-k5y2-w3bs
24
vulnerability VCID-fxtg-r97u-67eh
25
vulnerability VCID-hatj-wvm3-rfhc
26
vulnerability VCID-k45j-wnny-nfa2
27
vulnerability VCID-kee8-pqk2-kfcj
28
vulnerability VCID-ku6h-6thp-83fb
29
vulnerability VCID-me85-hcys-6fdq
30
vulnerability VCID-mqj9-khvp-2yca
31
vulnerability VCID-nfjk-e6e8-p3e9
32
vulnerability VCID-qh5p-6k6w-qyck
33
vulnerability VCID-qjmt-cfak-nqax
34
vulnerability VCID-qnbd-sejn-pfgp
35
vulnerability VCID-r9jc-krzs-xqaa
36
vulnerability VCID-rh68-hatq-rqbr
37
vulnerability VCID-rhfu-3c2s-1qf6
38
vulnerability VCID-rtyx-yt5p-sbdn
39
vulnerability VCID-s1fh-tmja-6qfe
40
vulnerability VCID-sjws-ab9q-3kbn
41
vulnerability VCID-smgv-8j8r-1ba9
42
vulnerability VCID-tnmx-z91x-a3cu
43
vulnerability VCID-uh88-xnv2-vfd6
44
vulnerability VCID-vgeq-urx5-mya1
45
vulnerability VCID-w7x5-qn5z-r3fk
46
vulnerability VCID-xxtt-z6tn-mqc5
47
vulnerability VCID-yc6x-egm8-cbgv
48
vulnerability VCID-z25b-g2p4-37dc
49
vulnerability VCID-zstw-f2zz-gqfw
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@4.4.0-beta
1
url pkg:composer/moodle/moodle@4.5.0-beta
purl pkg:composer/moodle/moodle@4.5.0-beta
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2h6c-6mgm-akc2
1
vulnerability VCID-4rt1-tzwg-4kgg
2
vulnerability VCID-4uwn-m5xb-8ufn
3
vulnerability VCID-5gaz-3z56-z7h6
4
vulnerability VCID-5j8c-enhg-2kgw
5
vulnerability VCID-5pak-k74c-6fda
6
vulnerability VCID-5wd4-h2bh-vyh9
7
vulnerability VCID-72zd-5ej9-bba2
8
vulnerability VCID-7z2w-xpn7-gbhm
9
vulnerability VCID-9put-kp7s-ybae
10
vulnerability VCID-a6w6-penj-kuds
11
vulnerability VCID-aa5b-kczd-a7cz
12
vulnerability VCID-aac8-q8g6-ebfw
13
vulnerability VCID-d2nv-u78g-wfab
14
vulnerability VCID-dd69-413v-qqhf
15
vulnerability VCID-de7j-3de2-s3ee
16
vulnerability VCID-eutz-ecg4-b3he
17
vulnerability VCID-evtb-ua7c-3fed
18
vulnerability VCID-ewey-azre-s3fh
19
vulnerability VCID-fcf4-tf5h-hfcr
20
vulnerability VCID-ftn9-k5y2-w3bs
21
vulnerability VCID-fxtg-r97u-67eh
22
vulnerability VCID-hatj-wvm3-rfhc
23
vulnerability VCID-k45j-wnny-nfa2
24
vulnerability VCID-kee8-pqk2-kfcj
25
vulnerability VCID-ku6h-6thp-83fb
26
vulnerability VCID-n36b-c9ch-6fgr
27
vulnerability VCID-qh5p-6k6w-qyck
28
vulnerability VCID-qnbd-sejn-pfgp
29
vulnerability VCID-rhfu-3c2s-1qf6
30
vulnerability VCID-rtyx-yt5p-sbdn
31
vulnerability VCID-s1fh-tmja-6qfe
32
vulnerability VCID-smgv-8j8r-1ba9
33
vulnerability VCID-tnmx-z91x-a3cu
34
vulnerability VCID-vgeq-urx5-mya1
35
vulnerability VCID-w7x5-qn5z-r3fk
36
vulnerability VCID-xxtt-z6tn-mqc5
37
vulnerability VCID-yc6x-egm8-cbgv
38
vulnerability VCID-ysax-7hvs-mkct
39
vulnerability VCID-zaff-9ezm-aba1
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@4.5.0-beta
2
url pkg:composer/moodle/moodle@5.0.0-beta
purl pkg:composer/moodle/moodle@5.0.0-beta
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2h6c-6mgm-akc2
1
vulnerability VCID-4uwn-m5xb-8ufn
2
vulnerability VCID-7z2w-xpn7-gbhm
3
vulnerability VCID-a6w6-penj-kuds
4
vulnerability VCID-aac8-q8g6-ebfw
5
vulnerability VCID-cghw-xbkf-juh9
6
vulnerability VCID-de7j-3de2-s3ee
7
vulnerability VCID-eutz-ecg4-b3he
8
vulnerability VCID-evtb-ua7c-3fed
9
vulnerability VCID-ewey-azre-s3fh
10
vulnerability VCID-fcf4-tf5h-hfcr
11
vulnerability VCID-jcxv-jtyh-f7e9
12
vulnerability VCID-k45j-wnny-nfa2
13
vulnerability VCID-qnbd-sejn-pfgp
14
vulnerability VCID-smgv-8j8r-1ba9
15
vulnerability VCID-xxtt-z6tn-mqc5
16
vulnerability VCID-ysax-7hvs-mkct
17
vulnerability VCID-zaff-9ezm-aba1
18
vulnerability VCID-zd4r-bn1p-27a5
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@5.0.0-beta
3
url pkg:composer/moodle/moodle@5.1.0-beta
purl pkg:composer/moodle/moodle@5.1.0-beta
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4uwn-m5xb-8ufn
1
vulnerability VCID-aac8-q8g6-ebfw
2
vulnerability VCID-eutz-ecg4-b3he
3
vulnerability VCID-evtb-ua7c-3fed
4
vulnerability VCID-ewey-azre-s3fh
5
vulnerability VCID-jcxv-jtyh-f7e9
6
vulnerability VCID-k45j-wnny-nfa2
7
vulnerability VCID-qnbd-sejn-pfgp
8
vulnerability VCID-smgv-8j8r-1ba9
9
vulnerability VCID-xxtt-z6tn-mqc5
10
vulnerability VCID-zaff-9ezm-aba1
11
vulnerability VCID-zd4r-bn1p-27a5
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@5.1.0-beta
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-67849
reference_id
reference_type
scores
0
value 7e-05
scoring_system epss
scoring_elements 0.0062
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-67849
1
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2423835
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-04T04:55:50Z/
url https://bugzilla.redhat.com/show_bug.cgi?id=2423835
2
reference_url https://github.com/moodle/moodle
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/moodle/moodle
3
reference_url https://github.com/moodle/moodle/commit/a3063dcaa44dbe66e60a37cadb33bfadfe4feb03
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/moodle/moodle/commit/a3063dcaa44dbe66e60a37cadb33bfadfe4feb03
4
reference_url https://moodle.org/mod/forum/discuss.php?d=471299
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://moodle.org/mod/forum/discuss.php?d=471299
5
reference_url https://access.redhat.com/security/cve/CVE-2025-67849
reference_id CVE-2025-67849
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-04T04:55:50Z/
url https://access.redhat.com/security/cve/CVE-2025-67849
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-67849
reference_id CVE-2025-67849
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-67849
7
reference_url https://github.com/advisories/GHSA-mhf6-pp52-8wqj
reference_id GHSA-mhf6-pp52-8wqj
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mhf6-pp52-8wqj
Weaknesses
0
cwe_id 79
name Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score7.0 - 8.9
Exploitability0.5
Weighted_severity8.0
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-ewey-azre-s3fh