CVE-2016-5013

Moodle Does Not Escape Characters In Email Headers

5.4 MediumFix available

CVE-2016-5013 is a medium vulnerability (CVSS 5.4) in Moodle, published January 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in moodle/moodle 3.0.5.

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.06%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.4

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Record: CVE-2016-5013
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-74
Updated: 2026-11-02

CVE List No score

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Record: CVE-2016-5013
Updated: 2026-11-02

EUVDEUVD-2022-1991 No score

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Record: EUVD-2022-1991
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2hh3-jmv8-5fmx 5.4

Moodle Does Not Escape Characters In Email Headers

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Record: GHSA-2hh3-jmv8-5fmx
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-74
Updated: 2026-11-02

OSV 5.4

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Record: CVE-2016-5013
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-2hh3-jmv8-5fmx 5.4

Moodle Does Not Escape Characters In Email Headers

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Record: GHSA-2hh3-jmv8-5fmx
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-74
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-5013 5.4

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.

Record: UBUNTU-CVE-2016-5013
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	3.0 to 3.0.4	3.0.5
`moodle/moodle` Packagist	2.9 to 2.9.6	2.9.7
`moodle/moodle` Packagist	2.8 to 2.8.12	None known
`moodle/moodle` Packagist	2.7 to 2.7.14	2.7.15
`moodle/moodle` Packagist	3.1 up to 3.1.1	3.1.1
`moodle/moodle` Packagist	3.1 up to 3.1.1, plus listed versions v3.1.0v3.1.0-betav3.1.0-rc1v3.1.0-rc2	3.1.1
`moodle/moodle` Packagist	3.0 up to 3.0.5, plus listed versions v3.0.0v3.0.0-betav3.0.0-rc1v3.0.0-rc2v3.0.0-rc3 Show 5 moreShow less v3.0.0-rc4v3.0.1v3.0.2v3.0.3v3.0.4	3.0.5
`moodle/moodle` Packagist	2.9 up to 2.9.7, plus listed versions v2.9.0v2.9.0-betav2.9.0-rc1v2.9.0-rc2v2.9.1 Show 5 moreShow less v2.9.2v2.9.3v2.9.4v2.9.5v2.9.6	2.9.7
`moodle/moodle` Packagist	2.8 to 2.8.12, plus listed versions v2.8.0v2.8.0-betav2.8.0-rc1v2.8.0-rc2v2.8.1 Show 11 moreShow less v2.8.10v2.8.11v2.8.12v2.8.2v2.8.3v2.8.4v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9	None known
`moodle/moodle` Packagist	2.7 up to 2.7.15, plus listed versions v2.7.0v2.7.0-betav2.7.0-rc1v2.7.0-rc2v2.7.1 Show 13 moreShow less v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9	2.7.15
`moodle` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known
`moodle` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References