CVE-2026-102586
EUVD-2026-8972530.09.2026, 09:17
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 𝑥 < 4.5.13 |
| moodle | moodle | 5.0.0 ≤ 𝑥 < 5.0.9 |
| moodle | moodle | 5.1.0 ≤ 𝑥 < 5.1.6 |
| moodle | moodle | 5.2.0 ≤ 𝑥 < 5.2.2 |
𝑥
= Vulnerable software versions
Ubuntu Releases