CVE-2023-23921

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.

• CWE-79
• CWE-79

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2162526Issue Tracking, Third Party Advisory
• https://moodle.org/mod/forum/discuss.php?d=443272#p1782021Patch, Vendor Advisory
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2162526Issue Tracking, Third Party Advisory
• https://moodle.org/mod/forum/discuss.php?d=443272#p1782021Patch, Vendor Advisory

Published

Feb 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23916An allocation of resources without limits or throttling vuln…6.5
• CVE-2023-23917A prototype pollution vulnerability exists in Rocket.Chat se…8.8
• CVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6…7.5
• CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18…7.5
• CVE-2023-2392A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
• CVE-2023-23920An untrusted search path vulnerability exists in Node.js. <1…4.2
• CVE-2023-23922The vulnerability was found Moodle which exists due to insuf…6.1
• CVE-2023-23923The vulnerability was found Moodle which exists due to insuf…8.2
• CVE-2023-23924Dompdf is an HTML to PDF converter. The URI validation on do…9.8
• CVE-2023-23925Switcher Client is a JavaScript SDK to work with Switcher AP…7.5
• CVE-2023-23926APOC (Awesome Procedures on Cypher) is an add-on library for…8.1
• CVE-2023-23927Craft is a platform for creating digital experiences. When y…5.4