Vulnerability Database

314,373

Total vulnerabilities in the database

CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.

Published: Jun 1, 2015
Updated: Nov 9, 2025
CVE: CVE-2015-0216
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
moodle / moodle	2.8.1	2.8.1.x
moodle / moodle	2.8.0	2.8.0.x

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48034
http://openwall.com/lists/oss-security/2015/01/19/1
https://moodle.org/mod/forum/discuss.php?d=278616

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo