onurcangnc/moodle-xss-pdfannotator

onurcangnc/moodle-xss-pdfannotator

GitHubGitHub
GitHubgithub.com
Releases0
The Moodle PDF Annotator plugin’s Public Comments feature doesn’t sanitize user input before displaying it in the PDF viewer. This allows low-privileged users to store malicious JavaScript that executes automatically when others open the annotated document, causing XSS attacks.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-60506↗
5.4 MEDIUM—

Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions.