CVE-2014-0218

Moodle cross-site scripting (XSS) vulnerability

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploit likelihood

1.84%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2014-0218
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-0218
Updated: 2026-11-02

EUVDEUVD-2022-3581 No score

Record: EUVD-2022-3581
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ch68-5r37-p7c3 No score

Moodle cross-site scripting (XSS) vulnerability

Record: GHSA-ch68-5r37-p7c3
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-ch68-5r37-p7c3 No score

Moodle cross-site scripting (XSS) vulnerability

Record: GHSA-ch68-5r37-p7c3
Weakness: CWE-79
Updated: 2026-11-02

OSVMGASA-2014-0230 No score

Updated moodle packages fix multiple vulnerabilities

Updated moodle package fixes security vulnerabilities:

In Moodle before 2.6.3, Session checking was not being performed correctly in Assignment's quick-grading, allowing forged requests to be made unknowingly by authenticated users (CVE-2014-0213).

In Moodle before 2.6.3, MoodleMobile web service tokens, created automatically in login/token.php, were not expiring and were valid forever (CVE-2014-0214).

In Moodle before 2.6.3, Some student details, including identities, were included in assignment marking pages and would have been revealed to screen readers or through code inspection (CVE-2014-0215).

In Moodle before 2.6.3, Access to files linked on HTML blocks on the My home page was not being checked in the correct context, allowing access to unauthenticated users (CVE-2014-0216).

In Moodle before 2.6.3, There was a lack of filtering in the URL downloader repository that could have been exploited for XSS (CVE-2014-0218).

The 2.4 branch of Moodle will no longer be supported as of approximately June 2014, so the Moodle package has been upgraded to version 2.6.3 to fix these issues.

Record: MGASA-2014-0230
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	before 2.4.10	2.4.10
`moodle/moodle` Packagist	2.5.0 up to 2.5.6	2.5.6
`moodle/moodle` Packagist	2.6.0 up to 2.6.3	2.6.3
`moodle/moodle` Packagist	before 2.4.10, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 14 moreShow less v2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9	2.4.10
`moodle/moodle` Packagist	2.5.0 up to 2.5.6, plus listed versions v2.5.0v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5	2.5.6
`moodle/moodle` Packagist	2.6.0 up to 2.6.3, plus listed versions v2.6.0v2.6.1v2.6.2	2.6.3
`moodle` Mageia:3 From an advisory covering 5 CVEs	before 2.6.3-1.mga3	2.6.3-1.mga3
`moodle` Mageia:4 From an advisory covering 5 CVEs	before 2.6.3-1.mga4	2.6.3-1.mga4

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0218 is a medium vulnerability (CVSS 4.3) in Moodle, published May 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in moodle/moodle 2.4.10.

References

Show 14 moreShow less