CVE-2021-27131

Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because the "Additional HTML Section" for "Header and Footer" can only be supplied by an administrator, who is intentionally allowed to enter unsanitized input (e.g., site-specific JavaScript).

• CWE-79

• https://docs.moodle.org/402/en/Risks
• https://github.com/moodle/moodleProduct
• https://github.com/p4nk4jv/CVEs-Assigned/blob/master/Moodle-3.10.1-CVE-2021-27131.mdExploit
• https://docs.moodle.org/402/en/Risks
• https://github.com/moodle/moodleProduct
• https://github.com/p4nk4jv/CVEs-Assigned/blob/master/Moodle-3.10.1-CVE-2021-27131.mdExploit

Published

May 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27114An issue was discovered in D-Link DIR-816 A2 1.10 B05 device…9.8
• CVE-2021-27116An issue was discovered in file profile.go in function MemPr…7.8
• CVE-2021-27117An issue was discovered in file profile.go in function GetCP…7.8
• CVE-2021-27124SQL injection in the expertise parameter in search_result.ph…6.5
• CVE-2021-27129CASAP Automated Enrollment System version 1.0 contains a cro…5.4
• CVE-2021-27130Online Reviewer System 1.0 contains a SQL injection vulnerab…9.8
• CVE-2021-27132SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF inject…9.8
• CVE-2021-27135xterm before Patch #366 allows remote attackers to execute a…9.8
• CVE-2021-27137An issue was discovered in router/upnp/src/ssdp.c in DD-WRT …8.1
• CVE-2021-27138The boot loader in Das U-Boot before 2021.04-rc2 mishandles …7.8
• CVE-2021-27139An issue was discovered on FiberHome HG6245D devices through…7.5
• CVE-2021-27140An issue was discovered on FiberHome HG6245D devices through…7.5