Moodle EUVD-2026-89725

Exploitation requires convincing an unauthenticated user to click a specially crafted password-reset link that injects script via the username field on Moodle's password reset page (UI:R). It is a reflected XSS, so no stored persistence or authentication is needed, but success is limited by the required user interaction (the victim must open the attacker-supplied link) and by browser/CSP protections that may block inline script. Impact is confined to the victim's browser session in the Moodle origin (S:U, C:L only) rather than server-side code execution. Affected versions are not specified in the provided data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) describes a reflected cross-site scripting flaw reachable over the network without authentication but requiring victim interaction, with only limited confidentiality impact and no integrity or availability impact - consistent with a low-to-moderate severity reflected XSS rather than a server-compromise bug. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so all exploitation-likelihood signals are absent; per the rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent (network reflected XSS gated by UI:R), so there is no CVSS-vs-description conflict to flag. Overall this is a real but modest-priority issue: exploitation depends on social-engineering a victim into clicking a crafted password-reset link, which caps practical impact, though Moodle's very large install base broadens the potential target pool.

An attacker crafts a malicious Moodle password-reset URL embedding a username value laced with script, then phishes an unauthenticated user into opening it. When the reset page renders the unsanitized username, the injected JavaScript executes in the victim's browser within the Moodle origin, enabling session-relevant data theft or UI manipulation. No public proof-of-concept exploit was identified at time of analysis.