CVE-2025-67855

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerability arises from insufficient sanitization of URL parameters, allowing attackers to inject malicious scripts through specially crafted links. Successful exploitation could lead to information disclosure or arbitrary client-side script execution within the user's browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
—	—	>= 4.1.0, < 4.1.22; >= 4.4.0, < 4.4.12; >= 4.5.0, < 4.5.8; >= 5.0.0, < 5.0.4; >= 5.1.0, < 5.1.1

References

https://access.redhat.com/security/cve/CVE-2025-67855Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2423861Third Party Advisory

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-678569.8A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allow CVE-2025-678575.3A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure CVE-2025-678587.0A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or furth CVE-2025-678595.1A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s lo CVE-2025-67865.3The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due t CVE-2025-678603.8A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as comman CVE-2025-678626.7An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6 CVE-2025-67875.4The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versio CVE-2025-678737.8Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata CVE-2025-678746.5ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by u CVE-2025-678755.4ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An au CVE-2025-678765.4ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 a