Moodle vulnerabilities

Products

• Moodle 641
• H5p 2
• Jmol Plugin 2

Newest

• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems CVE-2026-119556 5.3 MediumOctober 30, 2026
• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback CVE-2026-119555 5.3 MediumOctober 30, 2026
• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber CVE-2026-119554 6.0 MediumOctober 30, 2026
• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal CVE-2026-119553 7.1 HighOctober 30, 2026
• moodle Moodle: csrf in xml grade import CVE-2026-102588 Fix available 6.5 MediumSeptember 30, 2026
• moodle Moodle: user list filters bypass profile field visibility CVE-2026-102587 Fix available 2.7 LowSeptember 30, 2026
• moodle Moodle: xss via password reset link due to insufficient username escaping CVE-2026-102586 Fix available 4.3 MediumSeptember 30, 2026
• moodle Moodle: group validation missing when enrolling user to course CVE-2026-102585 Fix available 4.3 MediumSeptember 30, 2026
• moodle Moodle: missing capability check allows unauthorised grade penalty recalculation CVE-2026-102584 Fix available 4.3 MediumSeptember 30, 2026
• moodle Moodle: incorrect capability check in ai generate image web service CVE-2026-102583 Fix available 2.7 LowSeptember 30, 2026
• moodle Moodle: manual enrolment page accessible when plugin disabled CVE-2026-102582 Fix available 2.2 LowSeptember 30, 2026
• moodle Moodle: xss in forum post templates due to insufficient escaping CVE-2026-102581 Fix available 4.6 MediumSeptember 30, 2026
• moodle Moodle: arbitrary class instantiation via report builder audience classname CVE-2026-102580 Fix available 2.2 LowSeptember 30, 2026
• moodle Moodle: user profile information disclosure via grade web service CVE-2026-102579 Fix available 4.3 MediumSeptember 30, 2026
• moodle Moodle: sql injection in question bank web service CVE-2026-102578 Public exploitFix available 5.5 MediumSeptember 30, 2026
• moodle Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass CVE-2026-102577 Fix available 4.3 MediumSeptember 30, 2026
• moodle, moodle lms +1 more Moodle LMS 4.0 Cross-Site Scripting via course search.php CVE-2022-50943 5.1 MediumMay 10, 2026
• moodle Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service CVE-2026-26047 Fix available 6.5 MediumFebruary 21, 2026
• moodle Moodle: moodle: improper input sanitization in tex filter administration setting CVE-2026-26046 Fix available EPSS 13.8% 7.2 HighFebruary 21, 2026
• moodle Moodle: moodle: improper validation in file restore functionality leading to remote code execution CVE-2026-26045 Fix available 7.2 HighFebruary 21, 2026
• moodle Moodle: moodle: data exposure of user identifiers in urls CVE-2025-67857 Fix available 4.3 MediumFebruary 3, 2026
• moodle Moodle: moodle: privilege escalation via incomplete role checks in badge awarding CVE-2025-67856 Fix available 5.4 MediumFebruary 3, 2026
• moodle Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting CVE-2025-67855 Fix available 5.4 MediumFebruary 3, 2026
• moodle Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service CVE-2025-67853 Fix available 7.5 HighFebruary 3, 2026
• moodle Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites. CVE-2025-67852 Fix available 3.5 LowFebruary 3, 2026
• moodle Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export CVE-2025-67851 Fix available 6.1 MediumFebruary 3, 2026
• moodle Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor CVE-2025-67850 Fix available 7.3 HighFebruary 3, 2026
• moodle Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses CVE-2025-67849 Fix available 7.3 HighFebruary 3, 2026
• moodle Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access. CVE-2025-67848 Fix available 8.1 HighFebruary 3, 2026
• moodle Moodle: moodle: remote code execution via insufficient restore input validation CVE-2025-67847 Fix available 8.8 HighJanuary 23, 2026
• moodle Moodle 3.10.3 - 'label' Persistent Cross Site Scripting CVE-2021-47857 5.1 MediumJanuary 21, 2026
• moodle Moodle: possible to bypass timer in timed assignments CVE-2025-62401 Fix available 5.4 MediumOctober 23, 2025
• moodle Moodle: external cohort search service leaks system cohort data CVE-2025-62395 Fix available 4.3 MediumOctober 23, 2025
• moodle Moodle: hidden group names visible to event creators CVE-2025-62400 Fix available 4.3 MediumOctober 23, 2025
• moodle Moodle: password brute force risk when mobile/web services enabled CVE-2025-62399 Fix available 7.5 HighOctober 23, 2025
• moodle Moodle: possible to bypass mfa CVE-2025-62398 Fix available 5.4 MediumOctober 23, 2025
• moodle Moodle: router produces json instead of 404 error for invalid course id CVE-2025-62397 Fix available 5.3 MediumOctober 23, 2025
• moodle Moodle: router (r.php) could expose application directories CVE-2025-62396 Fix available 5.3 MediumOctober 23, 2025
• moodle Moodle: quiz notifications sent to suspended participants CVE-2025-62394 Fix available 4.3 MediumOctober 23, 2025
• moodle Moodle: course access permissions not properly checked in course_output_fragment_course_overview CVE-2025-62393 Fix available 4.3 MediumOctober 23, 2025
• geoffrowland jmol, moodle jmol plugin +1 more Moodle LMS Jmol Plugin Cross-site Scripting (XSS) CVE-2025-34032 5.1 MediumJune 24, 2025
• geoffrowland jmol, moodle jmol plugin +1 more Moodle LMS Jmol Plugin Path Traversal CVE-2025-34031 8.7 HighJune 24, 2025
• moodle Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter CVE-2025-53021 Fix available 4.2 MediumJune 24, 2025
• moodle Moodle: hidden grades shown to users without permission on some grade reports CVE-2025-32045 Fix available 5.3 MediumApril 25, 2025
• moodle Moodle: unauthenticated rest api user data exposure CVE-2025-32044 Public exploitFix available 7.5 HighApril 25, 2025
• moodle Moodle: idor when accessing the cohorts report CVE-2025-3647 Fix available 4.3 MediumApril 25, 2025
• moodle Moodle: idor in messaging web service allows access to some user details CVE-2025-3645 Fix available 4.3 MediumApril 25, 2025
• moodle Moodle: ajax section delete does not respect course_can_delete_section() CVE-2025-3644 Fix available 4.3 MediumApril 25, 2025
• moodle Moodle: reflected xss risk in policy tool CVE-2025-3643 Fix available 5.4 MediumApril 25, 2025
• moodle Moodle: authenticated remote code execution risk in the moodle lms equella repository CVE-2025-3642 Fix available 8.8 HighApril 25, 2025
• Show olderLoading…