CVE-2015-3275
Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
- Record
CVE-2015-3275- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
- Record
CVE-2015-3275- Updated
- 2026-11-02
EUVDEUVD-2022-2754 No score
Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
- Record
EUVD-2022-2754- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6922-5v25-p8jg
Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
- Record
GHSA-6922-5v25-p8jg- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-6922-5v25-p8jg
Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
- Record
GHSA-6922-5v25-p8jg- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3275
Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
- Record
UBUNTU-CVE-2015-3275- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2015-0302 No score
Updated moodle package fixes security vulnerabilities
In Moodle before 2.8.7, phishing is possible when redirecting to external site using referer headers in error messages (CVE-2015-3272).
In Moodle before 2.8.7, several web services returning user information did not clean text in text custom profile fields, leading to possible XSS (CVE-2015-3274).
In Moodle before 2.8.7, possible Javascript injection was discovered in the SCORM module (CVE-2015-3275).
As Moodle 2.6 is no longer supported, users of this package on Mageia 4 are advised to migrate to Mageia 5.
- Record
MGASA-2015-0302- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
2.7.0 up to 2.7.9 | 2.7.9 |
moodle/moodlePackagist |
2.8.0 up to 2.8.7 | 2.8.7 |
moodle/moodlePackagist |
2.9.0 up to 2.9.1 | 2.9.1 |
moodle/moodlePackagist |
2.7.0 up to 2.7.9, plus listed versions v2.7.0v2.7.1v2.7.2v2.7.3v2.7.4 Show 4 moreShow lessv2.7.5v2.7.6v2.7.7v2.7.8 |
2.7.9 |
moodle/moodlePackagist |
2.8.0 up to 2.8.7, plus listed versions v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5v2.8.6 |
2.8.7 |
moodle/moodlePackagist |
2.9.0 up to 2.9.1, plus listed versions v2.9.0 |
2.9.1 |
moodleMageia:5 From an advisory covering 3 CVEs |
before 2.8.7-1.mga5 | 2.8.7-1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3275 is a medium vulnerability (CVSS 6.1) in Moodle, published August 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in moodle/moodle 2.7.9.
References
openwall.com/lists/oss-security/2015/07/13/2
moodle.org/mod/forum/discuss.php?d=316665
securitytracker.com/id/1032877
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50614
nvd.nist.gov/vuln/detail/CVE-2015-3275
github.com/moodle/moodle/commit/46460a23035ad35caa50c2083ce6327f7723002e
Show 14 moreShow less
web.archive.org/web/20150924032214/http://www.securitytracker.com/id/1032877
advisories.mageia.org/MGASA-2015-0302.html
bugs.mageia.org/show_bug.cgi?id=16374
docs.moodle.org/dev/Moodle_2.8.7_release_notes
ubuntu.com/security/CVE-2015-3275
cve.org/CVERecord?id=CVE-2015-3275