CVE-2010-2230
Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
Exploit likelihood
What each source reports
NVD Score used
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Record
CVE-2010-2230- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Record
CVE-2010-2230- Updated
- 2026-11-02
EUVDEUVD-2022-2179 No score
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Record
EUVD-2022-2179- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3gm8-32vv-q8mp No score
Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Record
GHSA-3gm8-32vv-q8mp- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Record
CVE-2010-2230- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2230 No score
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Record
DEBIAN-CVE-2010-2230- Updated
- 2026-11-02
OSVGHSA-3gm8-32vv-q8mp No score
Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Record
GHSA-3gm8-32vv-q8mp- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
before 1.8.13 | 1.8.13 |
moodle/moodlePackagist |
1.9.0 up to 1.9.9 | 1.9.9 |
wordpressDebian:12 |
before 3.0.4+dfsg-1 | 3.0.4+dfsg-1 |
wordpressDebian:13 |
before 3.0.4+dfsg-1 | 3.0.4+dfsg-1 |
wordpressDebian:14 |
before 3.0.4+dfsg-1 | 3.0.4+dfsg-1 |
moodleDebian:5.0 From an advisory covering 13 CVEs |
before 1.8.13-1, plus listed versions 1.8.2.dfsg-31.8.2.dfsg-3+lenny11.8.2.dfsg-3+lenny21.8.2.dfsg-3+lenny31.8.2.dfsg-4 Show 4 moreShow less1.8.2.dfsg-51.8.2.dfsg-5.11.8.2.dfsg-61.8.2.dfsg-6.1 |
1.8.13-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2230 is a medium vulnerability (CVSS 4.0) in Moodle, published June 28, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. Fixed in moodle/moodle 1.8.13.
References
tracker.moodle.org/browse/MDL-22042
cvs.moodle.org/moodle/lib/weblib.php?r1=1.970.2.171&r2=1.970.2.172
docs.moodle.org/en/Moodle_1.8.13_release_notes
lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html
vupen.com/english/advisories/2010/1571
openwall.com/lists/oss-security/2010/06/21/2
Show 17 moreShow less
secunia.com/advisories/40352
moodle.org/mod/forum/discuss.php?d=152368
lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
bugzilla.redhat.com/show_bug.cgi?id=605809
nvd.nist.gov/vuln/detail/CVE-2010-2230
github.com/moodle/moodle/commit/704c5dfed4f4531b6d74d19cfad573984e74885e
web.archive.org/web/20100621005117/http://secunia.com/advisories/40248
security-tracker.debian.org/tracker/CVE-2010-2230