moodle/moodle vulnerabilities (Packagist)
437 vulnerabilities.
moodle/moodlePackagistMoodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service6.5 Mediummoodle/moodlePackagistMoodle: moodle: improper validation in file restore functionality leading to remote code execution7.2 Highmoodle/moodlePackagistMoodle: moodle: data exposure of user identifiers in urls4.3 Mediummoodle/moodlePackagistMoodle: moodle: privilege escalation via incomplete role checks in badge awarding5.4 Mediummoodle/moodlePackagistMooodle: mooodle: information disclosure and script execution via reflected cross-site scripting5.4 Mediummoodle/moodlePackagistMoodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service7.5 Highmoodle/moodlePackagistMoodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.3.5 Lowmoodle/moodlePackagistMoodle: moodle: formula injection allows arbitrary formula execution via unescaped data export6.1 Mediummoodle/moodlePackagistMoodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor7.3 Highmoodle/moodlePackagistMoodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses7.3 Highmoodle/moodlePackagistMoodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.8.1 Highmoodle/moodlePackagistMoodle: moodle: remote code execution via insufficient restore input validation8.8 Highmoodle/moodlePackagistMoodle: possible to bypass timer in timed assignments5.4 Mediummoodle/moodlePackagistMoodle: hidden group names visible to event creators4.3 Mediummoodle/moodlePackagistMoodle: password brute force risk when mobile/web services enabled7.5 Highmoodle/moodlePackagistMoodle: possible to bypass mfa5.4 Mediummoodle/moodlePackagistMoodle: router (r.php) could expose application directories5.3 Mediummoodle/moodlePackagistMoodle: quiz notifications sent to suspended participants4.3 Mediummoodle/moodlePackagistMoodle: course access permissions not properly checked in course_output_fragment_course_overview4.3 Mediummoodle/moodlePackagistMoodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter4.2 Mediummoodle/moodlePackagistMoodle: hidden grades shown to users without permission on some grade reports5.3 Mediummoodle/moodlePackagistMoodle: unauthenticated rest api user data exposure7.5 Highmoodle/moodlePackagistMoodle: idor when accessing the cohorts report4.3 Mediummoodle/moodlePackagistMoodle: idor in messaging web service allows access to some user details4.3 Mediummoodle/moodlePackagistMoodle: ajax section delete does not respect course_can_delete_section()4.3 Mediummoodle/moodlePackagistMoodle: reflected xss risk in policy tool5.4 Mediummoodle/moodlePackagistMoodle: authenticated remote code execution risk in the moodle lms equella repository8.8 Highmoodle/moodlePackagistMoodle: authenticated remote code execution risk in the moodle lms dropbox repository8.8 Highmoodle/moodlePackagistMoodle: idor in web service allows users enrolled in a course to access some details of other users4.3 Mediummoodle/moodlePackagistMoodle: csrf risk in brickfield tool's analysis request action8.8 Highmoodle/moodlePackagistMoodle: csrf token exposure via url in moodle mod_data module3.1 Lowmoodle/moodlePackagistMoodle: idor in moodle rss block allows unauthorized access to rss feeds4.3 Mediummoodle/moodlePackagistMoodle: csrf risk in moodle user tours manager allows tour duplication3.5 Lowmoodle/moodlePackagistMoodle: moodle assignment submission search leaks anonymous student identities4.3 Mediummoodle/moodlePackagistMoodle: partial data exposure in moodle before completing multi-factor authentication4.3 Mediummoodle/moodlePackagistMoodle: moodle allows course self-enrolment before completing mfa4.3 Mediummoodle/moodlePackagistSQL injection risk in course search module list filter8.1 Highmoodle/moodlePackagistTeachers can evade trusttext config when restoring glossary entries3.1 Lowmoodle/moodlePackagistIDOR in badges allows disabling of arbitrary badges3.1 Lowmoodle/moodlePackagistReflected XSS via question bank filter8.3 Highmoodle/moodlePackagistStored XSS risk in admin live log8.3 Highmoodle/moodlePackagistStored XSS in ddimageortext question type3.4 Lowmoodle/moodlePackagistNon-searchable tags can still be discovered on the tag search page and in the tags block5.3 Mediummoodle/moodlePackagistFeedback response viewing and deletions did not respect Separate Groups mode6.5 Mediummoodle/moodlePackagistArbitrary file read risk through pdfTeX8.6 Highmoodle/moodlePackagistMoodle: idor when accessing list of course badges4.3 Mediummoodle/moodlePackagistMoodle: lesson activity password bypass through php loose comparison5.4 Mediummoodle/moodlePackagistMoodle: idor when deleting oauth2 linked accounts7.5 Highmoodle/moodlePackagistMoodle: unprotected access to sensitive information via dynamic tables6.5 Mediummoodle/moodlePackagistMoodle: idor when fetching report schedules4.3 Medium- Show olderLoading…