CVE-2025-60507

Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.

• CWE-79

• https://github.com/onurcangnc/moodle_genai_plugin_xss
• https://moodle.org/plugins/local_geniai
• https://moodle.org/security/
• https://onurcangenc.com.tr/posts/moodle-genia%C4%B1-plugin-vulnerability-stored-reflected-xss-via-pdf-upload-and-chatbot-%C4%B1nput/

Published

Oct 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-60486A heap use-after-free in the dasher_process function (/filte…5.5
• CVE-2025-60495A segmentation violation in the gf_media_get_color_info func…5.5
• CVE-2025-6050Mezzanine CMS, in versions prior to 6.1.1, contains a Stored…4.8
• CVE-2025-60500QDocs Smart School Management System 7.1 allows authenticate…7.2
• CVE-2025-60503A cross-site scripting (XSS) vulnerability exists in the adm…8.7
• CVE-2025-60506Moodle PDF Annotator plugin v1.5 release 9 allows stored cro…5.4
• CVE-2025-6051A Regular Expression Denial of Service (ReDoS) vulnerability…5.3
• CVE-2025-60511Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers f…4.3
• CVE-2025-60514Tillywork v0.1.3 and below is vulnerable to SQL Injection in…6.5
• CVE-2025-6052A flaw was found in how GLib’s GString manages memory when a…7.5
• CVE-2025-6053The Zuppler Online Ordering plugin for WordPress is vulnerab…6.1
• CVE-2025-60534Blue Access Cobalt v02.000.195 suffers from an authenticatio…9.8