CVE-2024-37674

MediumCVSS 5.5

Published: 20/06/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

42th percentile - higher than 42% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

Risk Assessment

An attacker can inject malicious scripts, leading to session hijacking, website defacement, or theft of sensitive data.

Recommendation

Immediately update Moodle to the latest available version and implement input filtering and validation for the activity name field.

Original NVD description (English source)

Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.