CVE-2026-102581

MediumCVSS 5.4/10Last modified Oct 1, 2026

Description

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1025824.3A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, al CVE-2026-1025832.7A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web servic CVE-2026-1025844.3A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade pe CVE-2026-1025854.3A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the CVE-2026-1025866.1A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cro CVE-2026-1025872.7A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user wit CVE-2026-1025886.5A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an aut CVE-2026-102598.8A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the fi CVE-2026-1025964.3Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled thro CVE-2026-1025986.3Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL CVE-2026-1025997.5Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can CVE-2026-102607.3A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/