Search for vulnerabilities
Vulnerability details: VCID-eryd-1c23-wyd9
Vulnerability ID VCID-eryd-1c23-wyd9
Aliases CVE-2016-5013
GHSA-2hh3-jmv8-5fmx
Summary Moodle Does Not Escape Characters In Email Headers In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00363 https://api.first.org/data/v1/epss?cve=CVE-2016-5013
epss 0.00363 https://api.first.org/data/v1/epss?cve=CVE-2016-5013
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2hh3-jmv8-5fmx
cvssv3.1 5.4 https://github.com/moodle/moodle/commit/ed63718caa48803843a14140d8a27f04aba9c8c4
generic_textual MODERATE https://github.com/moodle/moodle/commit/ed63718caa48803843a14140d8a27f04aba9c8c4
cvssv3.1 5.4 https://moodle.org/mod/forum/discuss.php?d=336698
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=336698
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2016-5013
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2016-5013
cvssv3.1 5.4 https://web.archive.org/web/20210123154543/http://www.securityfocus.com/bid/92040
generic_textual MODERATE https://web.archive.org/web/20210123154543/http://www.securityfocus.com/bid/92040
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2016-5013
https://github.com/moodle/moodle/commit/ed63718caa48803843a14140d8a27f04aba9c8c4
https://moodle.org/mod/forum/discuss.php?d=336698
https://nvd.nist.gov/vuln/detail/CVE-2016-5013
https://web.archive.org/web/20210123154543/http://www.securityfocus.com/bid/92040
http://www.securityfocus.com/bid/92040
GHSA-2hh3-jmv8-5fmx https://github.com/advisories/GHSA-2hh3-jmv8-5fmx
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/moodle/moodle/commit/ed63718caa48803843a14140d8a27f04aba9c8c4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://moodle.org/mod/forum/discuss.php?d=336698
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-5013
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://web.archive.org/web/20210123154543/http://www.securityfocus.com/bid/92040
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.57562
EPSS Score 0.00363
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:26:43.078684+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2hh3-jmv8-5fmx/GHSA-2hh3-jmv8-5fmx.json 36.1.3