CVE-2014-3544

Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.

• CWE-79

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683Patch
• http://openwall.com/lists/oss-security/2014/07/21/1
• http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/Exploit
• http://osvdb.org/show/osvdb/109337
• http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.htmlExploit
• http://www.exploit-db.com/exploits/34169
• http://www.securityfocus.com/bid/68756
• https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95dPatch
• https://moodle.org/mod/forum/discuss.php?d=264265Vendor Advisory
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45683Patch
• http://openwall.com/lists/oss-security/2014/07/21/1
• http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xss/Exploit
• http://osvdb.org/show/osvdb/109337
• http://packetstormsecurity.com/files/127624/Moodle-2.7-Cross-Site-Scripting.htmlExploit
• http://www.exploit-db.com/exploits/34169
• http://www.securityfocus.com/bid/68756
• https://github.com/moodle/moodle/commit/ce5a785b0962c3c94c7a7b0d36176482d21db95dPatch
• https://moodle.org/mod/forum/discuss.php?d=264265Vendor Advisory

Published

Jul 29, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3538file before 5.19 does not properly restrict the amount of da…
• CVE-2014-3539base/oi/doa.py in the Rope library in CPython (aka Python) a…9.8
• CVE-2014-3540Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-3541The Repositories component in Moodle through 2.3.11, 2.4.x b…
• CVE-2014-3542mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2…
• CVE-2014-3543mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x befor…
• CVE-2014-3545Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5…
• CVE-2014-3546Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5…
• CVE-2014-3547Multiple cross-site scripting (XSS) vulnerabilities in badge…
• CVE-2014-3548Multiple cross-site scripting (XSS) vulnerabilities in Moodl…
• CVE-2014-3549Cross-site scripting (XSS) vulnerability in the get_descript…
• CVE-2014-3550Multiple cross-site scripting (XSS) vulnerabilities in admin…