Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-102586

Moodle: xss via password reset link due to insufficient username escaping

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

moodle

Default version status: unaffected

  • 5.2.0 to < 5.2.2affected
  • 5.1.0 to < 5.1.6affected
  • 5.0.0 to < 5.0.9affected
  • 0 to < 4.5.13affected

References