CVE-2025-60507 – Moodle GeniAI Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-60507

Published : Oct. 21, 2025, 6:15 p.m. | 27 minutes ago

Description : Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.

Severity: 8.9 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…