CVE-2008-1502
NoneCVSS
—
EPSS
10.5%
Published
Mar 25, 2008
CISA due date
—
The record
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | moodle/moodle | 0 | 1.8.5 |
| Debian:11 | wordpress | 0 | 2.5.0-1 |
| Debian:12 | wordpress | 0 | 2.5.0-1 |
| Debian:13 | wordpress | 0 | 2.5.0-1 |
| Debian:4.0 | moodle | 0 | 1.6.3-2+etch1 |
| Debian:4.0 | wordpress | 0 | 2.0.10-1etch4 |
| Debian:4.0 | wordpress | 0 | 2.0.10-1etch5 |
| Debian:5.0 | wordpress | 0 | 2.5.1-11+lenny1 |
Related vulnerabilities
- GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore Also affects moodle/moodle
- GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits Also affects moodle/moodle
- CVE-2026-26047 A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. Also affects moodle/moodle
- CVE-2026-26045 A flaw was identified in Moodle’s backup restore functionality where specially crafted… Also affects moodle/moodle
- GHSA-5cx4-w4fh-fr57 Moodle Affected by Improper Restriction of Excessive Authentication Attempts Also affects moodle/moodle
- GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data Also affects moodle/moodle
- GHSA-hcm6-q6pc-xfhm Moodle has an authorization logic flaw Also affects moodle/moodle
- GHSA-qv78-6gpp-hm68 Moodle Open Redirect vulnerability Also affects moodle/moodle