CVE-2025-60507: CVE-2025-60507: siteler arası betik çalıştırma (XSS)

Açıklama (NVD)

Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.

Özet bilgiler

CVSS v3.1

8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

EPSS

%0,31 (yüzdelik 24)

CWE

CWE-79

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• github.com
• moodle.org
• moodle.org
• onurcangenc.com.tr
• CWE-79