### [CVE-2021-20280](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20280)
![](https://img.shields.io/static/v1?label=Product&message=moodle&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79&color=brighgreen)

### Description

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

### POC

#### Reference
- http://packetstormsecurity.com/files/164817/Moodle-Cross-Site-Scripting-Server-Side-Request-Forgery.html

#### Github
No PoCs found on GitHub currently.