Search for packages
| purl | pkg:composer/moodle/moodle@2.6.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-114r-sgm2-57hp
Aliases: CVE-2021-20184 GHSA-mm73-86f9-5x5c |
Moodle Grade information disclosure in grade's external fetch functions It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades. |
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 145 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 110 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-1856-ncc9-vyd2
Aliases: CVE-2014-0215 GHSA-2fmv-j5xj-4fmq |
Moodle Reveals Student Information Meant To Be Anonymous The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source. |
Affected by 206 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 222 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-18u9-bd4n-1kcz
Aliases: CVE-2025-26531 GHSA-g88w-v4cq-qgcp |
Moodle has an IDOR in badges allows disabling of arbitrary badges Insufficient capability checks made it possible to disable badges a user does not have permission to access. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-1a6w-k5qe-6yem
Aliases: CVE-2024-48898 GHSA-fjq9-452g-jg3q |
moodle: Some users can delete audiences of other reports A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from. |
Affected by 19 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 22 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-1a9c-cmq6-3ydn
Aliases: CVE-2014-3617 GHSA-p5j7-26wj-423j |
Moodle allows discovery of an author's username The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q&A forum. |
Affected by 195 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 211 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-1n62-5dj6-b3fv
Aliases: CVE-2024-48897 GHSA-x3x9-349x-2485 |
moodle: IDOR in edit/delete RSS feed A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify. |
Affected by 19 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 22 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-1vdd-s58c-myhn
Aliases: CVE-2023-5545 GHSA-26fg-v32r-h663 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability H5P metadata automatically populated the author with the user's username, which could be sensitive information. |
Affected by 66 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-1vu5-s3hu-1kc2
Aliases: CVE-2014-7847 GHSA-6vjg-2q57-rgfw |
Moodle allows attackers to cause a denial of service iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumption) by triggering the calculation of an estimated latitude and longitude for an IP address. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-1y24-21a4-6fcx
Aliases: CVE-2020-1692 GHSA-9328-7pcw-vw69 |
Cross-Site Request Forgery in Moodle Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course. |
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2dzy-4vcd-a7a9
Aliases: CVE-2014-0218 GHSA-ch68-5r37-p7c3 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
Affected by 206 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2gr9-dvat-z7b4
Aliases: CVE-2019-10189 GHSA-h7xp-7fjp-ghhc |
moodle Improper Access Control A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment. |
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 127 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2jdf-d5tf-ffg1
Aliases: CVE-2017-2576 GHSA-cjrf-xg77-chpw |
Moodle Incorrect sanitation of attributes in forums In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. |
Affected by 138 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 135 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 135 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 140 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 154 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 145 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2kxn-yh3g-tkb9
Aliases: CVE-2021-36394 GHSA-2563-fp9c-mgm8 |
Moodle Session Fixation vulnerability In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2muw-jxf5-dyeh
Aliases: CVE-2021-36393 GHSA-f46j-r7q3-6cm2 |
Moodle SQL Injection vulnerability In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2srf-taxs-jfaw
Aliases: CVE-2025-26526 GHSA-pxg4-xjp7-w9c5 |
Moodle's feedback response viewing and deletions did not respect Separate Groups mode Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-2tm9-etey-1ubv
Aliases: CVE-2023-28331 GHSA-77jm-f3vj-xvx2 |
Moodle vulnerable to Cross-site Scripting Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. |
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 82 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-2vxx-842q-aqd3
Aliases: CVE-2019-18210 GHSA-q6vw-27c6-jv9c |
Moodle Persistent Cross-site Scripting (XSS) Persistent XSS in `/course/modedit.php` of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug." |
Affected by 121 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-38hq-mn8e-7ud1
Aliases: CVE-2023-35133 GHSA-xxp4-mf4h-6cwm |
Moodle vulnerable to Server Side Request Forgery An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions. |
Affected by 76 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 75 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 57 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-3b5u-7ww6-xydm
Aliases: CVE-2021-20183 GHSA-xhfx-rm8q-c3xv |
Moodle Vulnerable to Reflected Cross-site Scripting It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting (XSS) due to insufficient escaping of search queries. |
Affected by 110 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 68 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-3fc6-x9ed-nuex
Aliases: CVE-2025-3645 GHSA-pj96-xh2w-fgqx |
Moodle has an IDOR in messaging web service which allows access to some user details A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3skd-akkm-syer
Aliases: CVE-2014-7837 GHSA-p3hj-cfhm-7g6v |
Moodle allows attackers to remove wiki pages mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-3tq7-edtr-gybz
Aliases: CVE-2018-16854 GHSA-xj5f-qv37-r9jc |
Moodle Login CSRF vulnerability in login form A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15. |
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 129 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 149 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-3zm6-1wuw-mqcu
Aliases: CVE-2015-5342 GHSA-6xpm-q8x9-j3rw |
Moodle allows attackers to bypass intended access restrictions The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state. |
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-4158-fy1c-mqc3
Aliases: CVE-2024-43435 GHSA-4gq2-x5w4-7hp8 |
Moodle has insufficient capability checks A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-421h-cxn5-m7gt
Aliases: CVE-2015-5335 GHSA-hpmv-wvq3-gj27 |
Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL. |
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-426q-nnxa-v7d6
Aliases: CVE-2022-0335 GHSA-xpfv-89vg-r562 |
Cross Site Request Forgery in Moodle A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk. |
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 113 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 110 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 74 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 112 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-48nx-2gkv-jbch
Aliases: CVE-2024-1439 GHSA-5p2x-8427-9fgp |
Moodle Improper Access Control vulnerability Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent. |
Affected by 57 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-4d22-ptdz-nybp
Aliases: CVE-2022-0334 GHSA-93pj-4p65-qmr9 |
Insufficient user authorization in Moodle A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability. |
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 113 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 110 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 74 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 112 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-4dgg-buqq-9fdt
Aliases: CVE-2021-20187 GHSA-2jrm-gww7-wch2 |
Moodle Arbitrary PHP code execution by site admins via Shibboleth configuration It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication. |
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 145 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 110 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-4k5d-kee9-zqhv
Aliases: CVE-2014-9059 GHSA-crcq-pw8h-9xwf |
Moodle does not provide charset information in HTTP headers lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-4ru6-dsde-fye6
Aliases: CVE-2015-2270 GHSA-fp4h-j22r-vwcv |
Moodle allows attackers to obtain sensitive course information lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-4t46-y866-9yae
Aliases: CVE-2025-32045 GHSA-8m7c-hm88-2p97 |
Moodle shows hidden grades to users without permission on some grade reports A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-4xhe-xv4a-3kbx
Aliases: CVE-2021-40691 GHSA-92vh-mr2w-j2cr |
Moodle Improper Authentication A session hijack risk was identified in the Shibboleth authentication plugin. |
Affected by 117 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 120 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-5ad8-1asj-bud6
Aliases: CVE-2021-32473 GHSA-wx87-h539-4775 |
Moodle Information Disclosure vulnerability It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected |
Affected by 105 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-5eym-cmz8-9qc4
Aliases: CVE-2024-34004 GHSA-q3cm-ccrm-2mr6 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-5xde-3tcf-q3b5
Aliases: CVE-2025-26532 GHSA-cw24-f6fq-7j9v |
Moodle allows teachers to evade trusttext config when restoring glossary entries Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-65d2-5f6c-6yev
Aliases: CVE-2015-2267 GHSA-cm4r-58pj-h2ph |
Moodle allows attackers to extract archives to arbitrary directories mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-66fa-85ga-r7g3
Aliases: CVE-2024-33997 GHSA-9qgq-93c7-9hm4 |
Moodle stored Cross-site Scripting (XSS) Additional sanitizing was required when opening the equation editor to prevent a stored Cross-site Scripting (XSS) risk when editing another user's equation. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6cxv-u99k-zbea
Aliases: CVE-2024-34008 GHSA-68x5-4jg5-gjgg |
Moodle CSRF risk in analytics management of models Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6dfh-mncw-e7b4
Aliases: CVE-2023-28332 GHSA-9f45-9qrw-pp4v |
Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. |
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 82 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6e5f-5rat-7bek
Aliases: CVE-2024-43432 GHSA-7wmp-2xmx-g6h8 |
Moodle authorization headers preserved between "emulated redirects" A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6k1c-zm9s-quh2
Aliases: CVE-2024-34000 GHSA-8qwh-4vwv-7c5m |
Moodle Cross-site Scripting (XSS) ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6kw8-t3ku-wbc8
Aliases: CVE-2021-20186 GHSA-h8m4-h385-qhqv |
Moodle Cross-site Scripting It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS. |
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 145 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 110 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6m9a-pqb9-q3df
Aliases: CVE-2015-3180 GHSA-688p-pgj4-77hh |
Moodle allows attackers to obtain sensitive course-structure information lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6ndg-57m6-rbbc
Aliases: CVE-2024-43436 GHSA-mx26-62xm-2p83 |
Moodle vulnerable to site administration SQL injection via XMLDB editor A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6r25-8nh6-yygn
Aliases: CVE-2019-10154 GHSA-ww45-x87c-wgff |
Moodle all messaging conversations could be viewed A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations. |
Affected by 120 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6udp-mhxb-ufat
Aliases: CVE-2014-3541 GHSA-fccf-p8fx-vjj4 |
Moodle vulnerable to PHP object injection attacks The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-6yyz-jkdm-yye6
Aliases: CVE-2025-3642 GHSA-m367-445c-2xqr |
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-71up-8wxe-xqd4
Aliases: CVE-2021-36399 GHSA-79jp-m64f-pgrc |
Moodle Cross-site Scripting vulnerability In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-78ec-hxw7-87ew
Aliases: CVE-2016-2159 GHSA-cw72-69wq-f9f2 |
Moodle External function mod_assign_save_submission does not check due dates The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service request. |
Affected by 151 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-7uun-t12h-ryce
Aliases: CVE-2014-7848 GHSA-47cw-whh9-j2fq |
Moodle allows attacks to obtain sensitive information lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-82bu-yyz3-dqdk
Aliases: CVE-2025-3641 GHSA-c8v6-vxhf-wcrr |
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-8a4a-pz1v-zua5
Aliases: CVE-2015-3178 GHSA-9fmw-m4qx-6cq8 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-8d4j-48j3-4ug6
Aliases: CVE-2018-1045 GHSA-595j-wpfg-23w4 |
Moodle XSS Vulnerability In Moodle 3.x, there is XSS via a calendar event name. |
Affected by 140 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 129 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 136 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-8h6r-f99m-tqf2
Aliases: CVE-2025-26525 GHSA-4hmr-39vp-xfrr |
Moodle has an arbitrary file read risk through pdfTeX Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed). |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-8prn-y48f-83av
Aliases: CVE-2024-28593 GHSA-f6mh-79vh-2hv7 |
Cross-site Scripting in Moodle Chat The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be removed from standard Moodle." | There are no reported fixed by versions. |
|
VCID-8ukr-jeu9-17ej
Aliases: CVE-2014-7846 GHSA-468q-9cmp-76wc |
Moodle does not consider the moodle/tag:edit capability before adding a tag tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a tag, which allows remote authenticated users to bypass intended access restrictions via an AJAX request. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-94uw-ckcp-j7aq
Aliases: CVE-2021-36397 GHSA-2wmj-8mqg-r9q8 |
Moodle has Incorrect Default Permissions In Moodle, insufficient capability checks meant message deletions were not limited to the current user. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-985y-e6jk-nugk
Aliases: CVE-2023-28334 GHSA-hh52-g5c4-wprh |
Moodle may allow authenticated users to enumerate other user's names via learning plans page Authenticated users were able to enumerate other users' names via the learning plans page. |
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 82 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-9dyp-uwck-3bdw
Aliases: CVE-2015-3176 GHSA-fqrg-vmvj-jv3x |
Moodle allows attackers obtain full-name information The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-9q13-cj3m-53hd
Aliases: CVE-2025-3636 GHSA-chmf-m33p-ph8m |
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-a38w-c7bh-jye8
Aliases: CVE-2025-3643 GHSA-hxgg-4qww-85ph |
Moodle has reflected Cross-site Scripting risk in policy tool A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-a3w5-5sxv-hqd7
Aliases: CVE-2024-25982 GHSA-7pjp-fm93-p6pj |
Cross-Site Request Forgery in moodle The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. |
Affected by 58 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 38 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-a5sf-e28n-p3gs
Aliases: CVE-2023-5548 GHSA-cwh2-q44x-5w3c |
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. |
Affected by 66 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-a72f-ck6z-cfc1
Aliases: CVE-2014-7832 GHSA-mphj-h2fc-62x3 |
Moodle allows attackers to bypass the mod/lti:view capability requirement mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by viewing an activity instance. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-a8yx-3sca-17bp
Aliases: CVE-2014-3551 GHSA-m8f5-9wg8-2c3h |
Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-a9qc-hvhz-97gm
Aliases: CVE-2025-3640 GHSA-6g5x-h5x7-q4mq |
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-aar9-fxuv-t7d4
Aliases: CVE-2022-40208 GHSA-948f-j464-rfj2 |
Moodle may allow students to bypass sequential navigation during a quiz attempt In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt. |
Affected by 96 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 97 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-abrv-15hd-e7g2
Aliases: CVE-2015-5340 GHSA-mmvj-j7hq-rx85 |
Moodle sensitive information disclosure Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) `badges/overview.php` or (2) `badges/view.php`. |
Affected by 151 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-af9n-p79j-duc7
Aliases: CVE-2024-43440 GHSA-qrqv-26gf-xgwh |
Moodle LFI vulnerability when restoring malformed block backups A flaw was found in moodle. A local file may include risks when restoring block backups. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-aptm-2ap3-f3g1
Aliases: CVE-2014-7845 GHSA-9v64-447r-wch6 |
Moodle Temporary Passwords are Brute Force-able The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force attack. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-avsr-mhfs-wffw
Aliases: CVE-2015-5339 GHSA-gmhr-6f43-7qpj |
Moodle does not properly implement group-based access restrictions The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant information via a web-service request. |
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-b16m-tyxv-gyht
Aliases: CVE-2024-33996 GHSA-4qww-rxq6-x7gf |
Moodle broken access control when setting calendar event type Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-b2ju-zvk5-fye6
Aliases: CVE-2021-40694 GHSA-m37g-mwcg-7j7v |
Moodle Improper Encoding or Escaping of Output Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account. |
Affected by 117 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 120 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-bcff-6ka2-jyha
Aliases: CVE-2024-34005 GHSA-r99q-hmqv-xw8w |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-bkxf-gqyy-zqap
Aliases: CVE-2015-2266 GHSA-35pr-gqm6-r366 |
Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-bn7h-uupr-7fad
Aliases: CVE-2024-43438 GHSA-p9cx-f595-h79h |
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-bp5u-ujbs-qqhg
Aliases: CVE-2016-7038 GHSA-2phx-w35g-x9vm |
Moodle Weak Password Recovery Mechanism for Forgotten Password In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. |
Affected by 141 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 135 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 137 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 143 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-bpjm-vhwf-qudt
Aliases: CVE-2018-1042 GHSA-qqjv-mc2v-p7mc |
Moodle SSRF Vulnerability Moodle 3.x has Server Side Request Forgery in the filepicker. |
Affected by 140 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 129 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 136 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 142 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-bz78-2ntu-muat
Aliases: CVE-2023-5550 GHSA-5cvx-cwpx-9rjh |
Moodle Code Injection vulnerability In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution. |
Affected by 66 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ck54-csmd-63d2
Aliases: CVE-2024-43426 GHSA-vjmm-r9gg-425m |
Moodle has arbitrary file read risk through pdfTeX A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-d3de-2tk7-k3cm
Aliases: CVE-2025-26533 GHSA-rg56-94j7-hjx9 |
Moodle has a SQL injection risk in course search module list filter An SQL injection risk was identified in the module list filter within course search. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-d8uh-ygru-yyh8
Aliases: CVE-2019-10188 GHSA-92q5-2h76-vgmj |
moodle Improper Access Control A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. |
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 127 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-dhbw-2ucd-1bdr
Aliases: CVE-2024-43427 GHSA-vpq5-56jj-vf2m |
Moodle admin presets export tool includes some secrets that should not be exported A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-du5c-9q66-myc4
Aliases: CVE-2015-5268 GHSA-h34c-px28-rjgw |
Moodle mishandles group-based authorization checks The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value. |
Affected by 164 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 164 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-dv9g-2war-wybv
Aliases: CVE-2024-45689 GHSA-j822-x5gg-5r56 |
Moodle allows users to retrieve information they did not have permission to access A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access. |
Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 4 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-dwaw-jeyv-5ybs
Aliases: CVE-2024-43431 GHSA-wwjf-gwrv-wh45 |
Moodle's IDOR in badges allows deletion of arbitrary badges A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-e7yy-bm4y-tyhy
Aliases: CVE-2014-7830 GHSA-j4mr-vc54-h5pc |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse capability to provide a searchcourse parameter. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-e9dk-4y3m-c7fu
Aliases: CVE-2016-9188 GHSA-7ghm-fp7p-qvjq |
Moodle XSS Vulnerability Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-e9yy-zbv4-bqez
Aliases: CVE-2015-5337 GHSA-2hw6-6rgf-726v |
Moodle XSS Vulnerability Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file. |
Affected by 151 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-eb18-jb1s-v7f9
Aliases: CVE-2015-2269 GHSA-cp39-43xr-2wrp |
Moodle XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-egy8-5d4k-g3fq
Aliases: CVE-2015-2272 GHSA-5659-g9p4-354f |
Moodle allows attackers to bypass a forced-password-change requirement login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-eryd-1c23-wyd9
Aliases: CVE-2016-5013 GHSA-2hh3-jmv8-5fmx |
Moodle Does Not Escape Characters In Email Headers In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. |
Affected by 142 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 135 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 138 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 160 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-et6g-a452-vyg6
Aliases: CVE-2018-1081 GHSA-v9xq-vh72-chr4 |
Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed. |
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 139 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 128 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 140 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-evux-k98a-rubu
Aliases: CVE-2021-32475 GHSA-5wjh-v7c8-wrhx |
Moodle stored Cross-site Scripting ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. |
Affected by 105 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ey2v-dutw-13gg
Aliases: CVE-2019-3810 GHSA-wm4w-8vc6-2j4h |
Moodle XSS Vulnerability A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted. |
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 127 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 129 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 127 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 149 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 146 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 131 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 129 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-eyyx-qtsc-c7a6
Aliases: CVE-2016-2158 GHSA-m882-j7gq-v9p7 |
Moodle allows attackers to obtain sensitive category-detail information lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request. |
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-f6ck-gue9-6kac
Aliases: CVE-2015-5336 GHSA-grvw-qq2j-r898 |
Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer. |
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-fj5n-a4vh-eyfb
Aliases: CVE-2024-45691 GHSA-xfv7-h2qg-rjm7 |
Moodle Lesson activity password bypass through PHP loose comparison A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values. |
Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 4 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-fm1z-x877-q7ce
Aliases: CVE-2021-36402 GHSA-gv8f-43pg-c5qw |
Moodle Improper Input Validation vulnerability In affected versions of Moodle, users' names require additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. This issue has been patched in versions 3.9.8, 3.10.5 and 3.11.1. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-fndq-h77k-97a5
Aliases: CVE-2024-34003 GHSA-jg4f-8w9x-jv35 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-fxnn-zf49-vuhh
Aliases: CVE-2016-2190 GHSA-r9pc-g29w-f86j |
Moodle sensitive information disclosure Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log. |
Affected by 151 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-fysb-jb1y-abff
Aliases: CVE-2016-2151 GHSA-r3fc-hx6q-g6cq |
Moodle allows attackers to discover student e-mail addresses user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list. |
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-g5d5-6mh7-mke4
Aliases: CVE-2025-3638 GHSA-m8qh-hx4c-h9hr |
Moodle has a CSRF risk in Brickfield tool's analysis request action A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-gdfr-edmx-57av
Aliases: CVE-2014-3542 GHSA-xmwv-mqh8-4xgw |
Moodle allows remote attackers to read arbitrary files mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-gdr2-8sjp-kbb9
Aliases: CVE-2024-25978 GHSA-487g-3m3v-hjhq |
Uncontrolled Resource Consumption in moodle Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality. |
Affected by 58 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 38 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-gf7t-k2pn-gbhr
Aliases: CVE-2015-0217 GHSA-p497-37fc-xvvc |
Moodle allows attackers to cause a denial of service filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression. |
Affected by 174 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-gfs3-a82r-augs
Aliases: CVE-2015-3174 GHSA-6r7x-6q98-qcqp |
Moodle does not set the RISK_XSS bit for graders mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-gjzr-epee-cfhj
Aliases: CVE-2024-43439 GHSA-hjgc-jxjc-8v9j |
Moodle reflected XSS via H5P error message A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-gksf-snrk-9qb2
Aliases: CVE-2021-32476 GHSA-4qxc-qxrp-33cw |
Moodle denial-of-service risk in the draft files area A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. |
Affected by 105 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-h8s1-p4wb-9bb4
Aliases: CVE-2021-40693 GHSA-2jxg-mv2m-j4r7 |
Moodle type juggling vulnerability An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. |
Affected by 117 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 120 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-hm5y-j9ff-k7bh
Aliases: CVE-2015-5341 GHSA-c2r4-f8qv-2v7v |
Moodle allows attackers to read SCORM contents mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors. |
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-hnua-2hc4-8khx
Aliases: CVE-2015-3181 GHSA-622h-cjgg-5mx6 |
Moodle allows attackers to bypass file-management restrictions files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before approving a private-file upload, which allows remote authenticated users to bypass intended file-management restrictions by using web services to perform uploads after this capability has been revoked. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-hqeq-zjb3-vbgu
Aliases: CVE-2014-3545 GHSA-3m99-h3hp-w9j7 |
Moodle remote code execution via quiz questions Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-hrh8-nhh4-fyd7
Aliases: CVE-2015-0218 GHSA-5jph-mvfm-r27p |
Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout. |
Affected by 174 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-hs36-8yec-ebe7
Aliases: CVE-2014-7838 GHSA-43r4-vm25-qm78 |
Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within (1) mod/forum/deprecatedlib.php, (2) mod/forum/forum.js, (3) mod/forum/index.php, or (4) mod/forum/lib.php. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-huwe-36sb-y7c1
Aliases: CVE-2024-43434 GHSA-x87r-37q5-mmr8 |
Moodle has CSRF risk in Feedback non-respondents report The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-hz1u-sbcc-63fe
Aliases: CVE-2021-43559 GHSA-3jrj-x6cj-97cp |
Moodle contains CSRF vulnerability A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk. |
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 113 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-j1j9-2r5b-7ua9
Aliases: CVE-2024-33998 GHSA-xqhh-253w-4q5f |
Moodle Cross-site Scripting (XSS) Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-j6p2-cxjq-1qb1
Aliases: CVE-2021-36396 GHSA-4rmj-w58m-fvch |
Moodle vulnerable to Server-Side Request Forgery In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-j8gs-a5n2-2qdf
Aliases: CVE-2023-28336 GHSA-prjm-2fj2-787f |
Moodle may allow teachers to access the names of users they could not otherwise access Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access. |
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 82 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-jajm-qa34-dkdk
Aliases: CVE-2021-32478 GHSA-78fm-qhh8-8858 |
Moodle reflected XSS The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected. |
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-jfwt-fggx-nbej
Aliases: CVE-2024-43429 GHSA-c767-4whh-v7rw |
Moodle has user information visibility control issues in gradebook reports A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-juv1-9b3v-ruha
Aliases: CVE-2024-25979 GHSA-6vjf-48fh-vxxj |
Improper Handling of Parameters in moodle The URL parameters accepted by forum search were not limited to the allowed parameters. |
Affected by 58 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 38 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-jx5k-rfj3-1kcz
Aliases: CVE-2014-7833 GHSA-jq7x-gm9r-v8m7 |
Moodle allows attackers to obtain sensitive information mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-jynd-tu1w-qfbf
Aliases: CVE-2021-36401 GHSA-g6h6-4fp6-w33w |
Moodle vulnerable to Stored Cross-site Scripting In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-k2fn-xvte-qyhh
Aliases: CVE-2015-0212 GHSA-jj3j-mhgc-g4m4 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary. |
Affected by 174 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-k6jp-1vuq-3yhq
Aliases: CVE-2014-3544 GHSA-c9jp-244j-vh78 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-k9yg-meu5-mbhc
Aliases: CVE-2015-2268 GHSA-36cm-vrqh-8p98 |
Moodle allows attackers to cause a denial of service filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-kvfk-txqd-efgk
Aliases: CVE-2014-0217 GHSA-c3vx-v4x8-x894 |
Moodle does not check for the moodle/course:viewhiddencourses capability enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL. |
Affected by 206 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-m5qg-xqsa-xkcq
Aliases: CVE-2024-38274 GHSA-p5cg-6rfr-6mx8 |
Moodle stored XSS via calendar's event title when deleting the event Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. |
Affected by 40 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 21 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 47 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ma3y-9qsu-gqd2
Aliases: CVE-2025-3635 GHSA-88xj-97gf-7wpq |
Moodle has a CSRF risk in user tours manager that allows tour duplication A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-mhq4-qkyx-eua8
Aliases: CVE-2015-0214 GHSA-4jm2-c9jr-6prf |
Moodle allows attackers to bypass a messaging-disabled setting message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request. |
Affected by 174 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-mjnu-aqk2-m7c8
Aliases: CVE-2025-26529 GHSA-wr88-x8cm-7cgq |
Moodle has a stored XSS risk in admin live log Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-mm23-vgkg-hbdm
Aliases: CVE-2024-38277 GHSA-r82w-3phg-qvr4 |
Moodle uses the same key for QR login and auto-login A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. |
Affected by 40 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 21 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 47 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-muyw-551g-y7gf
Aliases: CVE-2023-35132 GHSA-49mv-vfcp-8gg9 |
Moodle vulnerable to SQL Injection A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions. |
Affected by 76 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 75 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 57 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-mwmh-am6d-afbh
Aliases: CVE-2023-1402 GHSA-vj5p-fp42-774p |
Moodle may display roles to users who don't have access to them The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. |
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 82 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-n2pd-ms5c-vfbq
Aliases: CVE-2020-14321 GHSA-9q29-jcjw-fw7h |
Moodle Incorrect Authorization vulnerability In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. |
Affected by 126 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 129 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 160 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ndy8-e9um-ayam
Aliases: CVE-2016-0724 GHSA-hjrj-7wcj-7j3c |
Moodle sensitive information disclosure The (1) `core_enrol_get_course_enrolment_methods` and (2) `enrol_self_get_instance_info` web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the `moodle/course:viewhiddencourses` capability, which allows remote authenticated users to obtain sensitive information via a web-service request. |
Affected by 151 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 155 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 154 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 154 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 160 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-nhaq-1w3c-9fdk
Aliases: CVE-2024-25983 GHSA-9r26-5w88-qhp9 |
Authorization Bypass in moodle Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page). |
Affected by 58 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 38 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-nhm9-ufuz-33cd
Aliases: CVE-2024-25980 GHSA-cp8m-h777-g4p3 |
Improper Access Control in moodle Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers. |
Affected by 58 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 38 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-nq6z-8wrv-4qbm
Aliases: CVE-2022-0985 GHSA-6q9g-3vfq-q2qj |
Improper Authentication in moodle Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability. |
Affected by 107 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 70 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 109 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-nuej-1dkx-67am
Aliases: CVE-2024-25981 GHSA-jfrg-9hpq-9hvp |
Improper Access Control in moodle Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers. |
Affected by 58 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 38 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-p182-4bq4-kqeq
Aliases: CVE-2024-34006 GHSA-vvh5-7v3m-j3mj |
Moodle Unsanitized HTML in site log for config_log_created The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-p4rf-gf33-abgw
Aliases: CVE-2024-38275 GHSA-p2cj-86v4-7782 |
Moodle HTTP authorization header is preserved between "emulated redirects" The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs. |
Affected by 40 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 21 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 47 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-pgqv-2wrf-d3fz
Aliases: CVE-2023-28330 GHSA-56r9-72vx-q989 |
Moodle arbitrary file read vulnerability Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default. |
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 82 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-pz62-p4jf-efb5
Aliases: CVE-2019-3849 GHSA-5wg9-5w3f-hxmh |
Moodle Users could elevate their role when accessing the LTI tool on a provider site A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site. |
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 141 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-q145-6uck-k3aj
Aliases: CVE-2024-34001 GHSA-gq9f-8rj4-w7jc |
Moodle CSRF risk in admin preset tool management of presets Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-q45u-xhmk-suhp
Aliases: CVE-2024-43428 GHSA-2r9m-wg35-rfvc |
Moodle vulnerable to cache poisoning via injection into storage To address a cache poisoning risk in Moodle, additional validation for local storage was required. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-q5cz-bbfa-kfc4
Aliases: CVE-2019-3848 GHSA-45rw-4r25-jvg7 |
Moodle Logged in users could view all calendar events A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.) |
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 141 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-qc8f-ksw8-vbg1
Aliases: CVE-2025-26527 GHSA-5r85-6h7f-rg3r |
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-qcvv-xx6u-gkax
Aliases: CVE-2018-1044 GHSA-332g-xh34-5c96 |
Moodle Privilege escalation in quiz web services In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings. |
Affected by 140 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 129 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 136 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 142 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-qef3-v2w4-mbef
Aliases: CVE-2014-7836 GHSA-wpq5-q3mj-8f3r |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/request_tool.php or (2) mod/lti/instructor_edit_tool_type.php request. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-qq9m-tv34-fubz
Aliases: CVE-2023-5549 GHSA-fm5h-58g2-4m3f |
Moodle Improper Access Control vulnerability Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage. |
Affected by 66 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-qu3t-pnc1-8ybr
Aliases: CVE-2022-0333 GHSA-m434-m5pv-p35w |
Insufficient user authorization in Moodle A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events. |
Affected by 100 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 113 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 110 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 74 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 112 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-r3n1-vcww-vyhx
Aliases: CVE-2014-0213 GHSA-h75f-hjcr-cvh8 |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of teachers for quick-grading requests. |
Affected by 206 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-r413-wkwu-wybe
Aliases: CVE-2015-2271 GHSA-v3wp-35g3-m9mm |
Moodle does not consider the moodle/tag:flag capability tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as inappropriate" feature. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-r4ev-h43h-17g1
Aliases: CVE-2024-45690 GHSA-fhg2-r2h9-h7q8 |
Moodle IDOR when deleting OAuth2 linked accounts A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts. |
Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 4 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 27 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rbc8-vjkw-rugz
Aliases: CVE-2016-2156 GHSA-h8vc-v44p-5r2q |
Moodle provides calendar-event data without considering whether an activity is hidden calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request. |
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rctc-2tw7-6yf3
Aliases: CVE-2021-36400 GHSA-35wf-3wq2-r3hx |
Moodle has Incorrect Default Permissions In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rcwf-j578-zkcm
Aliases: CVE-2023-5539 GHSA-3xxm-3g3c-w579 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers. |
Affected by 66 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rd28-mcq6-h3hj
Aliases: CVE-2015-5267 GHSA-382v-gxj9-ffhc |
Moodle uses predictable password-recovery tokens lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and complex_random_string functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. |
Affected by 164 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 164 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rjxe-nwdd-ffhx
Aliases: CVE-2019-10186 GHSA-wv9c-pfpm-4wc5 |
Moodle CSRF Vulnerability A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool. |
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 127 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rwbv-kmw8-bycg
Aliases: CVE-2021-36395 GHSA-273w-7fxj-pcp6 |
Moodle vulnerable to Uncontrolled Resource Consumption In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-rwr9-25we-n7ck
Aliases: CVE-2024-38273 GHSA-x29x-qwvx-fxr2 |
Moodle BigBlueButton web service leaks meeting joining information Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. |
Affected by 40 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 21 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 47 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-sap4-7qtw-jya4
Aliases: CVE-2016-9187 GHSA-58fm-v4pr-jh8p |
Moodle Unrestricted file upload vulnerability Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. |
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-sbnd-jcfh-zkfd
Aliases: CVE-2015-5338 GHSA-v33x-q8gh-4x42 |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php. |
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 156 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-sk4y-2sd8-bya9
Aliases: CVE-2024-43437 GHSA-4hjf-6pxr-549h |
Moodle Cross-site Scripting vulnerability A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-skn1-eh9h-gybv
Aliases: CVE-2015-0215 GHSA-fr9m-pjmm-qx9f |
Moodle allows attackers to obtain sensitive calendar-event information calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request. |
Affected by 174 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-squf-hvrj-pych
Aliases: CVE-2024-38276 GHSA-356g-7x36-7m34 |
Moodle CSRF risks due to misuse of confirm_sesskey Incorrect CSRF token checks resulted in multiple CSRF risks. |
Affected by 40 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 21 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 47 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-srvt-8pcd-gkfr
Aliases: CVE-2014-0216 GHSA-8rc7-4qfv-4484 |
Moodle does not properly restrict file access The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain sensitive information by visiting an HTML block. |
Affected by 206 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-tamk-777r-4bhn
Aliases: CVE-2019-10187 GHSA-2mg9-hv69-897x |
Moodle Ability to delete glossary entries that belong to another glossary A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to. |
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 127 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-tqde-42wn-mqbm
Aliases: CVE-2015-2273 GHSA-w77v-xpxr-c6pv |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response. |
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 180 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-tzfb-jgnk-mqam
Aliases: CVE-2015-0211 GHSA-frhc-9hwc-x7j3 |
Moodle allows attackers to obtain sensitive information mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service. |
Affected by 174 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-u24f-x23p-a7ay
Aliases: CVE-2014-3547 GHSA-hwjv-mc78-cccj |
Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-u8m1-kw8p-3khd
Aliases: CVE-2019-3850 GHSA-3fj7-9j8m-7r8g |
Moodle Stored HTML in assignment submission comments allowed links to be opened directly A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits. |
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 141 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ue4p-hp99-13b5
Aliases: CVE-2015-1493 GHSA-gphj-63h8-r9vq |
Moodle directory traversal vulnerability Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts. |
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 188 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 188 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ugmh-bzdg-1fan
Aliases: CVE-2015-3175 GHSA-h798-h7ff-93xv |
Moodle Arbitrary Redirect Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-uwvg-zdaw-bqge
Aliases: CVE-2014-3546 GHSA-4c5g-w3gf-rf4f |
Moodle allows attackers to obtain username and course information Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a modified URL. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-v1zc-czd1-huga
Aliases: CVE-2014-9060 GHSA-c87j-9rrq-h3j8 |
Moodle allows attackers to trigger the generation of arbitrary messages The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-v32y-srqy-tuap
Aliases: CVE-2024-48901 GHSA-mg54-p2wj-5ph7 |
moodle: IDOR when fetching report schedules A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report. |
Affected by 19 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 22 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-v4mk-j4rs-x7fy
Aliases: CVE-2023-5551 GHSA-jr83-8x65-xcr5 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. |
Affected by 66 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-vfyn-qqwr-8bg1
Aliases: CVE-2016-2153 GHSA-mj85-3hqq-r6r9 |
Moodle Reflected XSS in mod_data advanced search Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted field in a URL, as demonstrated by a search form field. |
Affected by 151 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-vpub-mtjm-wkba
Aliases: CVE-2014-7835 GHSA-vrf6-q7qj-69v5 |
Moodle allows attackers to upload files containing JavaScript webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting (XSS) attacks, by specifying the profile-picture area. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-vr3s-g1sm-nqhx
Aliases: CVE-2021-32474 GHSA-rvmc-8gmg-ggqr |
Moodle Blind SQL injection possible via MNet authentication An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. |
Affected by 105 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 134 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 98 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-w31q-wzp4-hqfw
Aliases: CVE-2016-2157 GHSA-f5pm-c4cw-563p |
Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins. |
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-w61p-fp6w-jqa5
Aliases: CVE-2024-48896 GHSA-cq5f-wv7p-5gfc |
Moodle leaks user names A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site. |
Affected by 19 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 23 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 22 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wgen-tp3a-ufhu
Aliases: CVE-2016-2152 GHSA-6mxm-wpqv-675h |
Moodle XSS from profile fields from external db Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field. |
Affected by 151 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 147 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 144 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wkyw-44v4-77ek
Aliases: CVE-2015-0213 GHSA-hhq7-jf2p-hw9c |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims. |
Affected by 174 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 189 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wqkw-4m9e-wuaa
Aliases: CVE-2024-43425 GHSA-v6f4-v8h8-3c87 |
Moodle Remote Code Execution vulnerability A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions. |
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 7 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 30 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 31 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wscf-whvj-nbab
Aliases: CVE-2023-28329 GHSA-72w2-j52c-7682 |
Moodle SQL Injection vulnerability Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers). |
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 79 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 81 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 82 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wve1-8q2j-jfc5
Aliases: CVE-2014-3548 GHSA-f66h-6mj2-rwj2 |
Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-wzrk-jv6g-2ych
Aliases: CVE-2025-26528 GHSA-h697-w4ph-7pcx |
Moodle has a stored XSS in ddimageortext question type The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-x1yz-usr2-xucj
Aliases: CVE-2021-43560 GHSA-g39c-mccf-rxjv |
Moodle Insecure direct object reference (IDOR) in a calendar web service A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events. |
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 113 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-xhjb-1dg9-sugz
Aliases: CVE-2014-3553 GHSA-mg69-5q59-8jcg |
Moodle does not enforce the moodle/site:accessallgroups capability requirement mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-xmfw-z3fk-4udm
Aliases: CVE-2024-29374 GHSA-3qw5-v9cc-v262 |
Cross site scripting in moodle A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter. |
Affected by 70 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-xnxa-fxgg-mfcj
Aliases: CVE-2014-3543 GHSA-27j2-c838-c3qg |
Moodle Arbitrary File Read via XML External Entity vulnerability `mod/imscp/locallib.php` in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format. |
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 212 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-xu77-z7j5-sqhg
Aliases: CVE-2014-0214 GHSA-48rq-vj58-2mh6 |
Moodle creates a MoodleMobile web-service token with an infinite lifetime login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack. |
Affected by 206 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-y7zk-twzm-jkgh
Aliases: CVE-2021-36392 GHSA-qc86-vgf2-6fq6 |
Moodle SQL Injection vulnerability In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-ye94-k7jf-hygm
Aliases: CVE-2015-5269 GHSA-5729-822w-j342 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description. |
Affected by 164 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 164 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 165 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-yech-qku7-tyht
Aliases: CVE-2025-3647 GHSA-34g7-pg9j-pxgp |
Moodle allows IDOR when accessing the cohorts report A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-yjxe-qdpw-7bhn
Aliases: CVE-2023-5540 GHSA-w8x2-w4qr-v3x4 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers. |
Affected by 66 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 65 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-yqdr-t8gg-23dt
Aliases: CVE-2025-3644 GHSA-cpm7-mv33-jwf8 |
Moodle's AJAX section delete does not respect course_can_delete_section() A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. |
Affected by 0 other vulnerabilities. Affected by 20 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-yxzy-2tsx-y3ff
Aliases: CVE-2019-3847 GHSA-qrcj-6fjw-3h9h |
Moodle XSS Vulnerability A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf. |
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 141 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 123 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-z8jg-d55k-yqfw
Aliases: CVE-2021-36403 GHSA-j9cw-5cpj-9qj5 |
Moodle has a Hidden Functionality vulnerability In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. |
Affected by 122 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 86 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 125 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-z91y-78kj-dufr
Aliases: CVE-2015-3179 GHSA-4ppg-2mx6-fqx9 |
Moodle allows attackers to bypass intended login restrictions login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account. |
Affected by 158 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 173 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zdk3-qaqm-qbc9
Aliases: CVE-2024-34002 GHSA-mm9p-xwfm-3fqf |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include. |
Affected by 45 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 26 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 50 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zg9w-z165-rff6
Aliases: CVE-2018-14630 GHSA-c3pr-h96w-2jjg |
Moodle XML import of ddwtos could lead to intentional remote code execution moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source. |
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 131 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 124 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 150 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zgng-aes8-akcx
Aliases: CVE-2017-15110 GHSA-rjh8-w8jg-xwq5 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students. |
Affected by 130 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 143 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 133 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 140 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zrsb-fq64-3kda
Aliases: CVE-2021-43558 GHSA-wpfp-q843-v772 |
Cross-site Scripting in moodle A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk. |
Affected by 101 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 113 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 77 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 116 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zv8k-xa2y-hqe1
Aliases: CVE-2014-7834 GHSA-557f-2hv4-7jjm |
Moodle does not verify group permissions mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service. |
Affected by 181 other vulnerabilities.
This version is affected by these other vulnerabilities:
Affected by 196 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
|
VCID-zwxu-ekr9-ekbq
Aliases: CVE-2023-5542 GHSA-8mm2-m2gp-c6x2 |
Moodle Improper Access Control vulnerability Students in "Only see own membership" groups could see other students in the group, which should be hidden. |
Affected by 41 other vulnerabilities.
This version is affected by these other vulnerabilities:
|
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-amwe-thzu-fkcc | Moodle allows attackers to obtain sensitive information The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module. |
CVE-2014-0124
GHSA-fc5p-vj3h-x7g4 |
| VCID-buy3-5v5q-nqbu | Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a quiz question. |
CVE-2014-2571
GHSA-75c6-xqwr-v2r9 |
| VCID-cfke-gsy3-cqd3 | Moodle places a session key in a URL repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner. |
CVE-2014-0125
GHSA-j465-7mp6-3xg3 |
| VCID-g3v5-snuz-8khy | Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file. |
CVE-2014-0126
GHSA-4wvg-7886-83gv |
| VCID-jf3s-9vxp-hbd8 | Moodle allows bypass of intended access restrictions mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator. |
CVE-2014-0122
GHSA-f9m9-494r-w36p |
| VCID-n4qs-agz1-afbb | Moodle allows attackers to modify the visibility of a badge badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors. |
CVE-2014-0129
GHSA-5rr5-fxhc-jv64 |
| VCID-nypx-x2z6-z7bd | Moodle attackers to modify grade metadata mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors. |
CVE-2014-2572
GHSA-267j-cwvg-j28c |
| VCID-sdqb-hs9t-tqeq | Moodle does not properly restrict access The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student. |
CVE-2014-0123
GHSA-2vhr-4mhq-m35c |
| VCID-w5s9-wjpe-bkc1 | Moodle cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342. |
CVE-2013-7341
GHSA-j6c3-3c4w-qv8p |
| VCID-xb25-rpyq-z7gy | Moodle's time-validation implementation allows bypassing intended restrictions The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time. |
CVE-2014-0127
GHSA-6p3g-hw27-qh44 |