Servers and applications

CVE-2018-1045

In Moodle 3.x, there is XSS via a calendar event name.

Severity: Medium 5.4
Published: 22 Jan 2018
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Exploit chance: 1% in the next 30 daysHigher than 62% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness: Cross-site scripting (CWE-79)
Attack: Over the network · Needs a user account · Needs someone to click or open something
Attacker can: Read some data · Change some data
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Sources: NVD

Affected software

Software	Affected versions
MoodleServers and applications · `cpe:a:moodle:moodle`	Version 3.3.3 Version 3.3.2 Version 3.3.1 Version 3.3.0 All 12 release lines Every version up to 3.1.9 Version 3.2.0 Version 3.2.1 Version 3.2.2 Version 3.2.3 Version 3.2.4 Version 3.2.5 Version 3.2.6 Version 3.3.0 Version 3.3.1 Version 3.3.2 Version 3.3.3