Skip to contentMoodle Project Moodle vulnerabilities
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitemsCVE-2026-1195565.3 Medium
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedbackCVE-2026-1195555.3 Medium
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumberCVE-2026-1195546.0 Medium
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path TraversalCVE-2026-1195537.1 High
- moodleSQL injection risk in course search module list filterCVE-2025-26533Fix available8.1 High
- moodleTeachers can evade trusttext config when restoring glossary entriesCVE-2025-26532Fix available3.1 Low
- moodleIDOR in badges allows disabling of arbitrary badgesCVE-2025-26531Fix available3.1 Low
- moodleReflected XSS via question bank filterCVE-2025-26530Fix available8.3 High
- moodleStored XSS risk in admin live logCVE-2025-26529Public exploitFix available8.3 High
- moodleStored XSS in ddimageortext question typeCVE-2025-26528Fix available3.4 Low
- moodleNon-searchable tags can still be discovered on the tag search page and in the tags blockCVE-2025-26527Fix available5.3 Medium
- moodleFeedback response viewing and deletions did not respect Separate Groups modeCVE-2025-26526Fix available6.5 Medium
- moodleArbitrary file read risk through pdfTeXCVE-2025-26525Fix available8.6 High