Unscored severity · published Feb 10, 2009
CVE-2009-0502
Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the "Login as" feature is used to visit a MyMoodle or Blog page.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Moodle · Moodle
1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +11 more · source: NVD
SN
Snoopy · Snoopy
1.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0502
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0502
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
Vendor Advisory
http://moodle.org/security/
secunia.com
http://secunia.com/advisories/33955
secunia.com
http://secunia.com/advisories/34418
www.debian.org
http://www.debian.org/security/2009/dsa-1724
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/02/04/1
More from Moodle
10.0
CVE-2019-3809
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions
9.8
CVE-2025-67856
Moodle: moodle: privilege escalation via incomplete role checks in badge awarding
9.8
CVE-2025-26533
SQL injection risk in course search module list filter
9.8
CVE-2024-33999
The referrer URL used by MFA required additional sanitizing, rather than being used directly
9.8
CVE-2023-5550
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the…