CVE-2021-36403

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-912

Affected software

Vendor	Product	Versions
n/a	Moodle	3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions

References

https://moodle.org/mod/forum/discuss.php?d=424809Patch, Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=424809Patch, Vendor Advisory

Timeline

Published: Mar 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-364085.5An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.CVE-2021-364097.8There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attack CVE-2021-36416.1Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools fo CVE-2021-364105.5A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265.CVE-2021-364115.5An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundar CVE-2021-364127.8A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows atta CVE-2021-364147.8A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service o CVE-2021-364177.8A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of CVE-2021-36425.3A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer ma CVE-2021-364249.8An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.CVE-2021-364255.4Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlin CVE-2021-364268.8File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general