CVE-2014-3545

Moodle remote code execution via quiz questions

6.0 MediumFix available

CVE-2014-3545 is a medium vulnerability (CVSS 6.0) in Moodle, published July 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile. Fixed in moodle/moodle 2.7.1.

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

Exploit likelihood

1.72%Down 3.6 points since Feb 4, 2022

What each source reports

NVD Score used 6.0

Record: CVE-2014-3545
CVSS 2.0: 6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-3545
Updated: 2026-11-02

EUVDEUVD-2022-2209 No score

Record: EUVD-2022-2209
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3m99-h3hp-w9j7 No score

Moodle remote code execution via quiz questions

Record: GHSA-3m99-h3hp-w9j7
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-3m99-h3hp-w9j7 No score

Moodle remote code execution via quiz questions

Record: GHSA-3m99-h3hp-w9j7
Weakness: CWE-94
Updated: 2026-11-02

OSVMGASA-2014-0308 No score

Updated moodle package fixes security vulnerabilities

In Moodle before 2.6.4, serialised data passed by repositories could potentially contain objects defined by add-ons that could include executable code (CVE-2014-3541).

In Moodle before 2.6.4, it was possible for manipulated XML files passed from LTI servers to be interpreted by Moodle to allow access to server-side files (CVE-2014-3542).

In Moodle before 2.6.4, it was possible for manipulated XML files to be uploaded to the IMSCC course format or the IMSCP resource to allow access to server-side files (CVE-2014-3543).

In Moodle before 2.6.4, filtering of the Skype profile field was not removing potentially harmful code (CVE-2014-3544).

In Moodle before 2.6.4, it was possible to inject code into Calculated questions that would be executed on the server (CVE-2014-3545).

In Moodle before 2.6.4, it was possible to get limited user information, such as user name and courses, by manipulating the URL of profile and notes pages (CVE-2014-3546).

In Moodle before 2.6.4, the details of badges from external sources were not being filtered (CVE-2014-3547).

In Moodle before 2.6.4, content of exception dialogues presented from AJAX calls was not being escaped before being presented to users (CVE-2014-3548).

In Moodle before 2.6.4, fields in rubrics were not being correctly filtered (CVE-2014-3551).

In Moodle before 2.6.4, forum was allowing users who were members of more than one group to post to all groups without the capability to access all groups (CVE-2014-3553).

The moodle package has been updated to version 2.6.4, to fix these issues and other bugs.

Record: MGASA-2014-0308
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	2.7.0 to 2.7.0	2.7.1
`moodle/moodle` Packagist	2.6.0 to 2.6.3	2.6.4
`moodle/moodle` Packagist	2.5.0 to 2.5.6	2.5.7
`moodle/moodle` Packagist	2.4.0 to 2.4.10	2.4.11
`moodle/moodle` Packagist	2.7.0 up to 2.7.1, plus listed versions v2.7.0	2.7.1
`moodle/moodle` Packagist	2.6.0 up to 2.6.4, plus listed versions v2.6.0v2.6.1v2.6.2v2.6.3	2.6.4
`moodle/moodle` Packagist	2.5.0 up to 2.5.7, plus listed versions v2.5.0v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6	2.5.7
`moodle/moodle` Packagist	2.4.0 up to 2.4.11, plus listed versions v2.4.0v2.4.1v2.4.10v2.4.2v2.4.3 Show 6 moreShow less v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9	2.4.11
`moodle` Mageia:3	before 2.6.4-1.mga3	2.6.4-1.mga3
`moodle` Mageia:4	before 2.6.4-1.mga4	2.6.4-1.mga4

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 22 moreShow less