Advisory details:
github_osv / GHSA-6mmv-f6c6-v6q8
| Advisory ID | github_osv/GHSA-6mmv-f6c6-v6q8 |
| Aliases |
CVE-2025-67850
|
| Summary | Moodle vulnerable to Cross-site Scripting A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.6 |
| Risk | 3.3 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-6mmv-f6c6-v6q8/GHSA-6mmv-f6c6-v6q8.json |
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/moodle/moodle | ||
| https://github.com/moodle/moodle/commit/c85f153068a717a3b28bc122e75154bac99e67e1 | ||
| https://moodle.org/mod/forum/discuss.php?d=471300 | ||
| CVE-2025-67850 | Advisory | https://access.redhat.com/security/cve/CVE-2025-67850 |
| CVE-2025-67850 | https://nvd.nist.gov/vuln/detail/CVE-2025-67850 | |
| show_bug.cgi?id=2423838 | Bug | https://bugzilla.redhat.com/show_bug.cgi?id=2423838 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-04T04:55:48Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/67xxx/CVE-2025-67850.json
Source Advisory: vulnrichment/CVE-2025-67850
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]