Skip to contentMoodle vulnerabilities
Newest
- moodle, fedoraproject fedora +1 moremoodle: BigBlueButton web service leaks meeting joining information to users who should not have accessCVE-2024-38273Fix available5.4 Medium
- moodlemoodle: ReCAPTCHA can be bypassed on the login pageCVE-2024-34009Fix available7.5 High
- moodlemoodle: CSRF risk in analytics management of modelsCVE-2024-34008Fix available8.8 High
- moodlemoodle: logout CSRF in admin/tool/mfa/auth.phpCVE-2024-34007Fix available8.8 High
- moodle, fedoraproject fedora +1 moremoodle: unsanitized HTML in site log for config_log_createdCVE-2024-34006Fix available4.3 Medium
- moodlemoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupCVE-2024-34005Fix available6.5 Medium
- moodlemoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupCVE-2024-34004Fix available6.5 Medium
- moodlemoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backupCVE-2024-34003Fix available5.9 Medium
- moodlemoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupCVE-2024-34002Fix available6.5 Medium
- moodlemoodle: CSRF risk in admin preset tool management of presetsCVE-2024-34001Fix available8.4 High
- moodlemoodle: stored XSS in lesson overview report via user ID numberCVE-2024-34000Fix available4.3 Medium
- moodlemoodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.phpCVE-2024-33999Fix available9.8 Critical
- moodlemoodle: stored XSS via user's name on participants page when opening some optionsCVE-2024-33998Fix available5.4 Medium
- moodlemoodle: stored XSS risk when editing another user's equation in equation editorCVE-2024-33997Fix available6.1 Medium
- moodlemoodle: broken access control when setting calendar event typeCVE-2024-33996Fix available6.2 Medium
- moodleCross-site Scripting in Moodle ChatCVE-2024-28593Fix availableDisputed5.4 Medium
- moodleCross site scripting in moodleCVE-2024-29374Fix available6.1 Medium
- fedoraproject fedora, moodle +1 moreMsa-24-0006: idor on dashboard comments blockCVE-2024-25983Fix available3.5 Low
- fedoraproject fedora, moodle +1 moreMsa-24-0005: csrf risk in language import utilityCVE-2024-25982Fix available4.3 Medium
- fedoraproject fedora, moodle +1 moreMsa-24-0004: forum export did not respect activity group settingsCVE-2024-25981Fix available4.3 Medium
- moodle h5p, fedoraproject fedora, moodle +2 moreMsa-24-0003: h5p attempts report did not respect activity group settingsCVE-2024-25980Fix available4.3 Medium
- fedoraproject fedora, moodle +1 moreMsa-24-0002: forum search accepted random parameters in its urlCVE-2024-25979Fix available5.3 Medium
- fedoraproject fedora, moodle +1 moreMsa-24-0001: denial of service risk in file picker unzip functionalityCVE-2024-25978Fix available7.5 High
- frappe lms, moodle +1 moreInadequate access control vulnerability in MoodleCVE-2024-1439Fix available6.5 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: duplicating a bigbluebutton activity assigns the same meeting idCVE-2023-5543Fix available3.3 Low
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: forum summary report shows students from other groups when in separate groups modeCVE-2023-5551Fix available3.3 Low
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: rce due to lfi risk in some misconfigured shared hosting environmentsCVE-2023-5550Fix available6.5 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: insufficient capability checks when updating the parent of a course categoryCVE-2023-5549Fix available3.3 Low
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: cache poisoning risk with endpoint revision numbersCVE-2023-5548Fix available3.3 Low
- moodle, fedoraproject fedora, redhat enterprise linux +2 moreMoodle: xss risk when previewing data in course upload toolCVE-2023-5547Fix available3.3 Low
- moodle, fedoraproject fedora, redhat enterprise linux +2 moreMoodle: stored xss in quiz grading report via user id numberCVE-2023-5546Public exploitFix available4.3 Medium
- moodle h5p, moodle, fedoraproject extra packages for enterprise linux +1 more +3 moreMoodle: auto-populated h5p author name causes a potential information leakCVE-2023-5545Fix available3.3 Low
- moodle, fedoraproject fedora, redhat enterprise linux +2 moreMoodle: stored xss and potential idor risk in wiki commentsCVE-2023-5544Fix available6.5 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: students can view other users in "only see own membership" groupsCVE-2023-5542Fix available3.3 Low
- moodleMoodle: xss risk when using csv grade import methodCVE-2023-5541Fix available3.3 Low
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: authenticated remote code execution risk in imscpCVE-2023-5540Fix available4.7 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: authenticated remote code execution risk in lessonCVE-2023-5539Fix available4.7 Medium
- moodle** DISPUTED ** Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when...CVE-2023-46858Fix availableDisputed5.4 Medium
- moodleMoodle: ssrf risk due to insufficient check on the curl blocked hostsCVE-2023-35133Fix available7.5 High
- moodleMoodle: minor sql injection risk on mnet sso access control pageCVE-2023-35132Fix available6.3 Medium
- moodleMoodle: xss risk on groups pageCVE-2023-35131Fix available6.1 Medium
- moodleMoodle vulnerable to stored Cross-site ScriptingCVE-2021-27131Fix availableDisputed5.4 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: minor sql injection risk in external wiki method for listing pagesCVE-2023-30944Fix available5.6 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: tinymce loaders susceptible to arbitrary folder creationCVE-2023-30943Public exploitFix available6.5 Medium
- moodleMoodle may allow students to bypass sequential navigation during a quiz attemptCVE-2022-40208Fix available4.3 Medium
- moodle, fedoraproject fedora +1 moreMoodle: teacher can access names of users they do not have permission to accessCVE-2023-28336Fix available4.3 Medium
- moodleMoodle: csrf risk in resetting all templates of a database activityCVE-2023-28335Fix available8.8 High
- moodleMoodle: users' name enumeration possible via idor on learning plans pageCVE-2023-28334Fix available4.3 Medium
- moodle, fedoraproject fedora +1 moreMoodle: pix helper potential mustache code injection riskCVE-2023-28333Fix available9.8 Critical
- moodleMoodle: algebra filter xss when filter is misconfiguredCVE-2023-28332Fix available6.1 Medium
- Show moreLoading…