CVE-2023-46858

Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."

• CWE-79

• https://docs.moodle.org/403/en/Security_FAQ#I_have_discovered_Cross_Site_Scripting_.28XSS.29_is_possible_with_MoodleProduct
• https://gist.github.com/Abid-Ahmad/12d2b4878eb731e8871b96b7d55125cdBroken Link
• https://packetstormsecurity.com/files/175277/Moodle-4.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://docs.moodle.org/403/en/Security_FAQ#I_have_discovered_Cross_Site_Scripting_.28XSS.29_is_possible_with_MoodleProduct
• https://gist.github.com/Abid-Ahmad/12d2b4878eb731e8871b96b7d55125cdBroken Link
• https://packetstormsecurity.com/files/175277/Moodle-4.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry

Published

Oct 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46850Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to…9.8
• CVE-2023-46851Allura Discussion and Allura Forum importing does not restri…4.9
• CVE-2023-46852In Memcached before 1.6.22, a buffer overflow exists when pr…7.5
• CVE-2023-46853In Memcached before 1.6.22, an off-by-one error exists when …9.8
• CVE-2023-46854Proxmox proxmox-widget-toolkit before 4.0.9, as used in mult…6.1
• CVE-2023-46857Squidex before 7.9.0 allows XSS via an SVG document to the U…5.4
• CVE-2023-4686The WP Customer Reviews plugin for WordPress is vulnerable t…4.3
• CVE-2023-46862An issue was discovered in the Linux kernel through 6.5.9. D…4.7
• CVE-2023-46863Peppermint Ticket Management before 0.2.4 allows remote atta…7.5
• CVE-2023-46864Peppermint Ticket Management through 0.2.4 allows remote att…5.3
• CVE-2023-46865/api/v1/company/upload-logo in CompanyController.php in crat…7.2
• CVE-2023-46866In International Color Consortium DemoIccMAX 79ecb74, CIccCL…6.5