CVE-2011-4286: Moodle vulnerable to Cross-site Scripting

May 13, 2022 (updated April 12, 2025)

Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos.

References

github.com/advisories/GHSA-86v9-gqh9-8268
nvd.nist.gov/vuln/detail/CVE-2011-4286

Code Behaviors & Features

Detect and mitigate CVE-2011-4286 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →