CVE-2010-1615
Moodle vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- Record
CVE-2010-1615- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- Record
CVE-2010-1615- Updated
- 2026-11-02
EUVDEUVD-2010-1641 No score
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- Record
EUVD-2010-1641- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9xp2-5fr9-7mwm
Moodle vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- Record
GHSA-9xp2-5fr9-7mwm- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-9xp2-5fr9-7mwm
Moodle vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- Record
GHSA-9xp2-5fr9-7mwm- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
1.8.0 up to 1.8.12 | 1.8.12 |
moodle/moodlePackagist |
1.9.0 up to 1.9.8 | 1.9.8 |
moodleDebian:5.0 From an advisory covering 13 CVEs |
before 1.8.13-1, plus listed versions 1.8.2.dfsg-31.8.2.dfsg-3+lenny11.8.2.dfsg-3+lenny21.8.2.dfsg-3+lenny31.8.2.dfsg-4 Show 4 moreShow less1.8.2.dfsg-51.8.2.dfsg-5.11.8.2.dfsg-61.8.2.dfsg-6.1 |
1.8.13-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-1615 is a high vulnerability (CVSS 7.5) in Moodle, published April 29, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile. Fixed in moodle/moodle 1.8.12.
References
cvs.moodle.org/moodle/lib/form/selectgroups.php?r1=1.2.4.2&r2=1.2.4.3
vupen.com/english/advisories/2010/1107
moodle.org/security
lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
nvd.nist.gov/vuln/detail/CVE-2010-1615
github.com/advisories/GHSA-9xp2-5fr9-7mwm