CVE-2025-60507

State: Published
Severity: 8.9 High
Published: Oct 21, 2025
Updated: Oct 21, 2025
Reserved: Sep 26, 2025

Description

Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.

Scores

CVSS	Score	Vector	Source
3.1	8.9 High	CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:R	mitre

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://moodle.org/security/
https://onurcangenc.com.tr/posts/moodle-genia%C4%B1-plugin-vulnerability-stored-reflected-xss-via-pdf-upload-and-chatbot-%C4%B1nput/
https://github.com/onurcangnc/moodle_genai_plugin_xss
https://moodle.org/plugins/local_geniai

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.