Skip to contentMoodle vulnerabilities
Newest
- moodleMoodle: authenticated remote code execution risk in the moodle lms dropbox repositoryCVE-2025-3641Fix available8.8 High
- moodleMoodle: idor in web service allows users enrolled in a course to access some details of other usersCVE-2025-3640Fix available4.3 Medium
- moodleMoodle: csrf risk in brickfield tool's analysis request actionCVE-2025-3638Fix available8.8 High
- moodleMoodle: csrf token exposure via url in moodle mod_data moduleCVE-2025-3637Fix available3.1 Low
- moodleMoodle: idor in moodle rss block allows unauthorized access to rss feedsCVE-2025-3636Fix available4.3 Medium
- moodleMoodle: csrf risk in moodle user tours manager allows tour duplicationCVE-2025-3635Fix available3.5 Low
- moodleMoodle: moodle assignment submission search leaks anonymous student identitiesCVE-2025-3628Fix available4.3 Medium
- moodleMoodle: partial data exposure in moodle before completing multi-factor authenticationCVE-2025-3627Fix available4.3 Medium
- moodleMoodle: user dos and name disclosure via idor in moodle mfa email factor revoke actionCVE-2025-3625Fix available7.1 High
- moodleMoodle: moodle allows course self-enrolment before completing mfaCVE-2025-3634Fix available4.3 Medium
- moodleSQL injection risk in course search module list filterCVE-2025-26533Fix available8.1 High
- moodleTeachers can evade trusttext config when restoring glossary entriesCVE-2025-26532Fix available3.1 Low
- moodleIDOR in badges allows disabling of arbitrary badgesCVE-2025-26531Fix available3.1 Low
- moodleReflected XSS via question bank filterCVE-2025-26530Fix available8.3 High
- moodleStored XSS risk in admin live logCVE-2025-26529Public exploitFix available8.3 High
- moodleStored XSS in ddimageortext question typeCVE-2025-26528Fix available3.4 Low
- moodleNon-searchable tags can still be discovered on the tag search page and in the tags blockCVE-2025-26527Fix available5.3 Medium
- moodleFeedback response viewing and deletions did not respect Separate Groups modeCVE-2025-26526Fix available6.5 Medium
- moodleArbitrary file read risk through pdfTeXCVE-2025-26525Fix available8.6 High
- moodleMoodle: idor when accessing list of course badgesCVE-2024-48899Fix available4.3 Medium
- moodleMoodle: lesson activity password bypass through php loose comparisonCVE-2024-45691Fix available5.4 Medium
- moodleMoodle: idor when deleting oauth2 linked accountsCVE-2024-45690Fix available7.5 High
- moodleMoodle: unprotected access to sensitive information via dynamic tablesCVE-2024-45689Fix available6.5 Medium
- moodleMoodle: idor when fetching report schedulesCVE-2024-48901Fix available4.3 Medium
- moodleMoodle: some users can delete audiences of other reportsCVE-2024-48898Fix available4.3 Medium
- moodleMoodle: idor in edit/delete rss feedCVE-2024-48897Fix available4.3 Medium
- moodleMoodle: users' names returned in messaging error messageCVE-2024-48896Fix available4.3 Medium
- moodleMoodle: idor when accessing list of badge recipientsCVE-2024-48900Fix available4.3 Medium
- moodleMoodle: reflected xss via h5p error messageCVE-2024-43439Fix available5.4 Medium
- moodleMoodle: xss risk when restoring malicious course backup fileCVE-2024-43437Fix available5.4 Medium
- moodleMoodle: can create global glossary without being adminCVE-2024-43435Fix available5.3 Medium
- moodleMoodle: matrix user/power level management not always working as expected with suspended usersCVE-2024-43433Fix available5.3 Medium
- moodleMoodle: authorization headers preserved between "emulated redirects"CVE-2024-43432Fix available5.3 Medium
- moodleMoodle: lack of access control when using external methods for quiz overridesCVE-2024-43430Fix available5.3 Medium
- moodleMoodle: user information visibility control issues in gradebook reportsCVE-2024-43429Fix available5.3 Medium
- moodleMoodle: admin presets export tool includes some secrets that should not be exportedCVE-2024-43427Fix available3.7 Low
- moodleMoodle: lfi vulnerability when restoring malformed block backupsCVE-2024-43440Fix available7.5 High
- moodleMoodle: idor in feedback non-respondents report allows messaging arbitrary site usersCVE-2024-43438Fix available7.5 High
- moodleMoodle: site administration sql injection via xmldb editorCVE-2024-43436Fix available7.2 High
- moodleMoodle: csrf risk in feedback non-respondents reportCVE-2024-43434Fix available8.1 High
- moodleMoodle: idor in badges allows deletion of arbitrary badgesCVE-2024-43431Fix available7.5 High
- moodleMoodle: cache poisoning via injection into storageCVE-2024-43428Fix available7.7 High
- moodleMoodle: arbitrary file read risk through pdftexCVE-2024-43426Fix available7.5 High
- moodleMoodle: remote code execution via calculated question typesCVE-2024-43425Public exploitFix availableEPSS 87.5%8.1 High
- moodle virtual programming lab, vpl jail system +1 moreVirtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting ...CVE-2024-34312Public exploit6.1 Medium
- moodleCross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute...CVE-2024-37674Fix available5.5 Medium
- moodle, fedoraproject fedora +1 moremoodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keysCVE-2024-38277Fix available5.4 Medium
- moodle, fedoraproject fedora +1 moremoodle: CSRF risks due to misuse of confirm_sesskeyCVE-2024-38276Fix available8.8 High
- moodlemoodle: HTTP authorization header is preserved between "emulated redirects"CVE-2024-38275Fix available7.5 High
- moodle, fedoraproject fedora +1 moremoodle: stored XSS via calendar's event title when deleting the eventCVE-2024-38274Fix available6.1 Medium
- Show moreLoading…