Moodle Project vulnerabilities

Products

• Moodle 13

Newest

• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems CVE-2026-119556 5.3 MediumOctober 30, 2026
• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback CVE-2026-119555 5.3 MediumOctober 30, 2026
• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber CVE-2026-119554 6.0 MediumOctober 30, 2026
• moodle Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal CVE-2026-119553 7.1 HighOctober 30, 2026
• moodle SQL injection risk in course search module list filter CVE-2025-26533 Fix available 8.1 HighFebruary 24, 2025
• moodle Teachers can evade trusttext config when restoring glossary entries CVE-2025-26532 Fix available 3.1 LowFebruary 24, 2025
• moodle IDOR in badges allows disabling of arbitrary badges CVE-2025-26531 Fix available 3.1 LowFebruary 24, 2025
• moodle Reflected XSS via question bank filter CVE-2025-26530 Fix available 8.3 HighFebruary 24, 2025
• moodle Stored XSS risk in admin live log CVE-2025-26529 Public exploitFix available 8.3 HighFebruary 24, 2025
• moodle Stored XSS in ddimageortext question type CVE-2025-26528 Fix available 3.4 LowFebruary 24, 2025
• moodle Non-searchable tags can still be discovered on the tag search page and in the tags block CVE-2025-26527 Fix available 5.3 MediumFebruary 24, 2025
• moodle Feedback response viewing and deletions did not respect Separate Groups mode CVE-2025-26526 Fix available 6.5 MediumFebruary 24, 2025
• moodle Arbitrary file read risk through pdfTeX CVE-2025-26525 Fix available 8.6 HighFebruary 24, 2025