CVE-2018-14631

—

CVSS 3.0

6.1 medium

EPSS

2%p77

Published

Sep 17, 2018 (Sep 17, 2018)

Modified

Jun 17, 2026

Description

moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.

Vendors: moodle
Products: moodle
Weakness: CWE-20, CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.8%)

In the news0 stories

No ingested article mentions this CVE yet.