CVE-2011-4280
Moodle vulnerable to XSS via bundled spikephpcoverage library
CVE-2011-4280 is a medium vulnerability (CVSS 4.3) in Moodle, published July 16, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.62%, the 89th percentile. Fixed in moodle/moodle 2.0.2.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 3.62%EPSS, 89th percentile
- Exploitation
- None known1 public exploit
- Fixed in
2.0.2moodle/moodle
Description
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist | 2.0 up to 2.0.2 | 2.0.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Moodle 2.0.1 - 'PHPCOVERAGE_HOME' Cross-Site Scripting | 2011-02-01 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2011-4280- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2011-4280- Updated
- 2026-11-02
EUVDEUVD-2022-4646No score
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
EUVD-2022-4646- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mx5g-3vxh-rgm8No score
Moodle vulnerable to XSS via bundled spikephpcoverage library
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
GHSA-mx5g-3vxh-rgm8- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-mx5g-3vxh-rgm8No score
Moodle vulnerable to XSS via bundled spikephpcoverage library
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Record
GHSA-mx5g-3vxh-rgm8- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2011/11/14/1
git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=bd654f0ced8af925c27b7c94321f0c299b50b38e
moodle.org/mod/forum/discuss.php?d=170005
nvd.nist.gov/vuln/detail/CVE-2011-4280
github.com/moodle/moodle/commit/bd654f0ced8af925c27b7c94321f0c299b50b38e