CVE-2020-25627

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/aMoodle3.9 to 3.9.1

References

Timeline

Published
Dec 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-256286.1The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7CVE-2020-256298.8A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain accessCVE-2020-25634.2Vulnerability in the Hyperion Financial Close Management product of Oracle Hyperion (component: Close Manager). The supported version that iCVE-2020-256307.5A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping tCVE-2020-256316.1A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapCVE-2020-256328.2A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without CVE-2020-256335.3A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentiaCVE-2020-256345.4A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitivCVE-2020-256355.5A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is compleCVE-2020-256367.1A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are CVE-2020-256376.7A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about netCVE-2020-256387.4A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteri
CVE-2020-25627: Medium severity, CVSS 6.1 | Vulnix