In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.

Affected Packages

Packagist moodle/moodle

Affected versions: 3.9.0 (fixed in 3.9.3)

Related CVEs

CVE-2020-25702

Key Information

GHSA ID

GHSA-pgcp-m69h-p2gr

Published

March 29, 2021 8:43 PM

Last Modified

March 24, 2021 11:15 PM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

moodle/moodle

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 15, 2025 6:24 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.