CVE-2025-60506
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
21/10/2025
Última modificación:
22/10/2025
Descripción
*** Pendiente de traducción *** Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions.
Impacto
Puntuación base 3.x
5.40
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/onurcangnc/moodle-xss-pdfannotator
- https://onurcangenc.com.tr/blog/moodle-xss-pdfannotator
- https://onurcangenc.com.tr/posts/cve-2025-60506-stored-cross-site-scripting-xss-in-moodle-pdf-annotator-plugin-v1-5-release-9/
- https://onurcangenc.com.tr/posts/cve-2025-60506-stored-cross-site-scripting-xss-in-moodle-pdf-annotator-plugin-v1-5-release-9/