Search for packages
| purl | pkg:composer/moodle/moodle@2.3.7 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-w29j-8phw-ffjf
Aliases: CVE-2025-62401 |
Moodle has a time restriction bypass An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, … |
Vulnerable |
|
GHSA-m58f-9pvv-8mp2
Aliases: CVE-2025-62399 |
Moodle vulnerable to brute-force password guesses Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, … |
Vulnerable |
|
GHSA-422v-w6c5-vq42
Aliases: CVE-2025-62400 |
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view … |
Vulnerable |
|
GHSA-cpm7-mv33-jwf8
Aliases: CVE-2025-3644 |
Moodle's AJAX section delete does not respect course_can_delete_section() A flaw was found in Moodle. Additional checks were required to prevent … |
Vulnerable |
|
GHSA-88xj-97gf-7wpq
Aliases: CVE-2025-3635 |
Moodle has a CSRF risk in user tours manager that allows tour duplication A security vulnerability was discovered in Moodle … |
Vulnerable |
|
GHSA-chmf-m33p-ph8m
Aliases: CVE-2025-3636 |
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds A flaw was found in Moodle. This … |
Vulnerable |
|
GHSA-hxgg-4qww-85ph
Aliases: CVE-2025-3643 |
Moodle has reflected Cross-site Scripting risk in policy tool A flaw was found in Moodle. The return URL in the … |
Vulnerable |
|
GHSA-m8qh-hx4c-h9hr
Aliases: CVE-2025-3638 |
Moodle has a CSRF risk in Brickfield tool's analysis request action A flaw was found in Moodle. The analysis request … |
Vulnerable |
|
GHSA-34g7-pg9j-pxgp
Aliases: CVE-2025-3647 |
Moodle allows IDOR when accessing the cohorts report A flaw was discovered in Moodle. Additional checks were required to ensure … |
Vulnerable |
|
GHSA-pj96-xh2w-fgqx
Aliases: CVE-2025-3645 |
Moodle has an IDOR in messaging web service which allows access to some user details A flaw was found in … |
Vulnerable |
|
GHSA-8m7c-hm88-2p97
Aliases: CVE-2025-32045 |
Moodle shows hidden grades to users without permission on some grade reports A flaw has been identified in Moodle where … |
Vulnerable |
|
GHSA-m367-445c-2xqr
Aliases: CVE-2025-3642 |
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository A flaw was found in Moodle. … |
Vulnerable |
|
GHSA-c8v6-vxhf-wcrr
Aliases: CVE-2025-3641 |
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository A flaw was found in Moodle. … |
Vulnerable |
|
GHSA-6g5x-h5x7-q4mq
Aliases: CVE-2025-3640 |
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other … |
Vulnerable |
|
GHSA-g88w-v4cq-qgcp
Aliases: CVE-2025-26531 |
Moodle has an IDOR in badges allows disabling of arbitrary badges Insufficient capability checks made it possible to disable badges … |
Vulnerable |
|
GHSA-wr88-x8cm-7cgq
Aliases: CVE-2025-26529 |
Moodle has a stored XSS risk in admin live log Description information displayed in the site administration live log required … |
Vulnerable |
|
GHSA-4hmr-39vp-xfrr
Aliases: CVE-2025-26525 |
Moodle has an arbitrary file read risk through pdfTeX Insufficient sanitizing in the TeX notation filter resulted in an arbitrary … |
Vulnerable |
|
GHSA-h697-w4ph-7pcx
Aliases: CVE-2025-26528 |
Moodle has a stored XSS in ddimageortext question type The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to … |
Vulnerable |
|
GHSA-pxg4-xjp7-w9c5
Aliases: CVE-2025-26526 |
Moodle's feedback response viewing and deletions did not respect Separate Groups mode Separate Groups mode restrictions were not factored into … |
Vulnerable |
|
GHSA-cw24-f6fq-7j9v
Aliases: CVE-2025-26532 |
Moodle allows teachers to evade trusttext config when restoring glossary entries Additional checks were required to ensure trusttext is applied … |
Vulnerable |
|
GHSA-rg56-94j7-hjx9
Aliases: CVE-2025-26533 |
Moodle has a SQL injection risk in course search module list filter An SQL injection risk was identified in the … |
Vulnerable |
|
GHSA-5r85-6h7f-rg3r
Aliases: CVE-2025-26527 |
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block Tags not expected … |
Vulnerable |
|
GHSA-2hmm-q272-xmhf
Aliases: CVE-2022-40314 |
Moodle remote code execution A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. |
Vulnerable |
|
GHSA-c5hf-mc85-2hx4
Aliases: CVE-2022-0984 |
Missing authorization in Moodle Users with the capability to configure badge criteria (teachers and managers by default) were able to … |
Vulnerable |
|
GHSA-64r3-582j-frqm
Aliases: CVE-2013-4941 |
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through … |
Vulnerable |
|
GHSA-w77v-xpxr-c6pv
Aliases: CVE-2015-2273 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before … |
Vulnerable |
|
GHSA-fqrg-vmvj-jv3x
Aliases: CVE-2015-3176 |
Moodle allows attackers obtain full-name information The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before … |
Vulnerable |
|
GHSA-h75f-hjcr-cvh8
Aliases: CVE-2014-0213 |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in … |
Vulnerable |
|
GHSA-gphj-63h8-r9vq
Aliases: CVE-2015-1493 |
Moodle directory traversal vulnerability Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, … |
Vulnerable |
|
GHSA-468q-9cmp-76wc
Aliases: CVE-2014-7846 |
Moodle does not consider the moodle/tag:edit capability before adding a tag tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x … |
Vulnerable |
|
GHSA-fp4h-j22r-vwcv
Aliases: CVE-2015-2270 |
Moodle allows attackers to obtain sensitive course information lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and … |
Vulnerable |
|
GHSA-fccf-p8fx-vjj4
Aliases: CVE-2014-3541 |
Moodle vulnerable to PHP object injection attacks The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, … |
Vulnerable |
|
GHSA-c9jp-244j-vh78
Aliases: CVE-2014-3544 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before … |
Vulnerable |
|
GHSA-6p3g-hw27-qh44
Aliases: CVE-2014-0127 |
Moodle's time-validation implementation allows bypassing intended restrictions The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, … |
Vulnerable |
|
GHSA-43r4-vm25-qm78
Aliases: CVE-2014-7838 |
Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module Multiple cross-site request forgery (CSRF) vulnerabilities in the … |
Vulnerable |
|
GHSA-9ww8-j8j2-3788
Aliases: CVE-2013-4942 |
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through … |
Vulnerable |
|
GHSA-crcq-pw8h-9xwf
Aliases: CVE-2014-9059 |
Moodle does not provide charset information in HTTP headers lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, … |
Vulnerable |
|
GHSA-xmwv-mqh8-4xgw
Aliases: CVE-2014-3542 |
Moodle allows remote attackers to read arbitrary files mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x … | There are no reported fixed by versions. |
|
GHSA-75c6-xqwr-v2r9
Aliases: CVE-2014-2571 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x … |
Vulnerable |
|
GHSA-688p-pgj4-77hh
Aliases: CVE-2015-3180 |
Moodle allows attackers to obtain sensitive course-structure information lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and … |
Vulnerable |
|
GHSA-4ppg-2mx6-fqx9
Aliases: CVE-2015-3179 |
Moodle allows attackers to bypass intended login restrictions login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and … |
Vulnerable |
|
GHSA-6r7x-6q98-qcqp
Aliases: CVE-2015-3174 |
Moodle does not set the RISK_XSS bit for graders mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, … |
Vulnerable |
|
GHSA-2vhr-4mhq-m35c
Aliases: CVE-2014-0123 |
Moodle does not properly restrict access The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and … |
Vulnerable |
|
GHSA-jq7x-gm9r-v8m7
Aliases: CVE-2014-7833 |
Moodle allows attackers to obtain sensitive information mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x … |
Vulnerable |
|
GHSA-f9m9-494r-w36p
Aliases: CVE-2014-0122 |
Moodle allows bypass of intended access restrictions mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x … |
Vulnerable |
|
GHSA-fr9m-pjmm-qx9f
Aliases: CVE-2015-0215 |
Moodle allows attackers to obtain sensitive calendar-event information calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and … |
Vulnerable |
|
GHSA-2m72-m5cw-3g9h
Aliases: CVE-2021-20283 |
Missing permission check in Moodle The web service responsible for fetching other users' enrolled courses did not validate that the … |
Vulnerable |
|
GHSA-j6c3-3c4w-qv8p
Aliases: CVE-2013-7341 |
Moodle cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through … |
Vulnerable |
|
GHSA-ch68-5r37-p7c3
Aliases: CVE-2014-0218 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, … |
Vulnerable |
|
GHSA-8rc7-4qfv-4484
Aliases: CVE-2014-0216 |
Moodle does not properly restrict file access The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through … |
Vulnerable |
|
GHSA-hhq7-jf2p-hw9c
Aliases: CVE-2015-0213 |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in … |
Vulnerable |
|
GHSA-j4mr-vc54-h5pc
Aliases: CVE-2014-7830 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x … |
Vulnerable |
|
GHSA-5wg9-5w3f-hxmh
Aliases: CVE-2019-3849 |
Moodle Users could elevate their role when accessing the LTI tool on a provider site A vulnerability was found in … |
Vulnerable |
|
GHSA-p3hj-cfhm-7g6v
Aliases: CVE-2014-7837 |
Moodle allows attackers to remove wiki pages mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x … |
Vulnerable |
|
GHSA-c87j-9rrq-h3j8
Aliases: CVE-2014-9060 |
Moodle allows attackers to trigger the generation of arbitrary messages The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, … |
Vulnerable |
|
GHSA-fc5p-vj3h-x7g4
Aliases: CVE-2014-0124 |
Moodle allows attackers to obtain sensitive information The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before … |
Vulnerable |
|
GHSA-5659-g9p4-354f
Aliases: CVE-2015-2272 |
Moodle allows attackers to bypass a forced-password-change requirement login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and … |
Vulnerable |
|
GHSA-vm9c-39jx-q45w
Aliases: CVE-2013-4522 |
Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x … |
Vulnerable |
|
GHSA-6vjg-2q57-rgfw
Aliases: CVE-2014-7847 |
Moodle allows attackers to cause a denial of service iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, … |
Vulnerable |
|
GHSA-mphj-h2fc-62x3
Aliases: CVE-2014-7832 |
Moodle allows attackers to bypass the mod/lti:view capability requirement mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before … |
Vulnerable |
|
GHSA-9fmw-m4qx-6cq8
Aliases: CVE-2015-3178 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x … |
Vulnerable |
|
GHSA-4jm2-c9jr-6prf
Aliases: CVE-2015-0214 |
Moodle allows attackers to bypass a messaging-disabled setting message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and … |
Vulnerable |
|
GHSA-4wvg-7886-83gv
Aliases: CVE-2014-0126 |
Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, … |
Vulnerable |
|
GHSA-5jph-mvfm-r27p
Aliases: CVE-2015-0218 |
Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, … |
Vulnerable |
|
GHSA-36cm-vrqh-8p98
Aliases: CVE-2015-2268 |
Moodle allows attackers to cause a denial of service filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, … |
Vulnerable |
|
GHSA-j465-7mp6-3xg3
Aliases: CVE-2014-0125 |
Moodle places a session key in a URL repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and … |
Vulnerable |
|
GHSA-wxqg-fg7v-mmc6
Aliases: CVE-2013-3630 |
Moodle Authenticated Spelling Binary Remote Code Execution Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring … |
Vulnerable |
|
GHSA-mg69-5q59-8jcg
Aliases: CVE-2014-3553 |
Moodle does not enforce the moodle/site:accessallgroups capability requirement mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x … |
Vulnerable |
|
GHSA-qrcj-6fjw-3h9h
Aliases: CVE-2019-3847 |
Moodle XSS Vulnerability A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login … |
Vulnerable |
|
GHSA-f66h-6mj2-rwj2
Aliases: CVE-2014-3548 |
Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before … |
Vulnerable |
|
GHSA-4c5g-w3gf-rf4f
Aliases: CVE-2014-3546 |
Moodle allows attackers to obtain username and course information Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before … |
Vulnerable |
|
GHSA-jj3j-mhgc-g4m4
Aliases: CVE-2015-0212 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before … |
Vulnerable |
|
GHSA-cm4r-58pj-h2ph
Aliases: CVE-2015-2267 |
Moodle allows attackers to extract archives to arbitrary directories mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, … |
Vulnerable |
|
GHSA-cp39-43xr-2wrp
Aliases: CVE-2015-2269 |
Moodle XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, … | There are no reported fixed by versions. |
|
GHSA-35pr-gqm6-r366
Aliases: CVE-2015-2266 |
Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before … |
Vulnerable |
|
GHSA-h798-h7ff-93xv
Aliases: CVE-2015-3175 |
Moodle Arbitrary Redirect Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before … | There are no reported fixed by versions. |
|
GHSA-622h-cjgg-5mx6
Aliases: CVE-2015-3181 |
Moodle allows attackers to bypass file-management restrictions files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x … |
Vulnerable |
|
GHSA-frhc-9hwc-x7j3
Aliases: CVE-2015-0211 |
Moodle allows attackers to obtain sensitive information mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x … |
Vulnerable |
|
GHSA-48rq-vj58-2mh6
Aliases: CVE-2014-0214 |
Moodle creates a MoodleMobile web-service token with an infinite lifetime login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before … |
Vulnerable |
|
GHSA-m8f5-9wg8-2c3h
Aliases: CVE-2014-3551 |
Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x … |
Vulnerable |
|
GHSA-p497-37fc-xvvc
Aliases: CVE-2015-0217 |
Moodle allows attackers to cause a denial of service filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, … |
Vulnerable |
|
GHSA-wpq5-q3mj-8f3r
Aliases: CVE-2014-7836 |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through … |
Vulnerable |
|
GHSA-p5j7-26wj-423j
Aliases: CVE-2014-3617 |
Moodle allows discovery of an author's username The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x … |
Vulnerable |
|
GHSA-v3wp-35g3-m9mm
Aliases: CVE-2015-2271 |
Moodle does not consider the moodle/tag:flag capability tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x … |
Vulnerable |
|
GHSA-9q29-jcjw-fw7h
Aliases: CVE-2020-14321 |
Moodle Incorrect Authorization vulnerability In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign … |
Vulnerable |
|
GHSA-h2fw-93qx-vrcq
Aliases: CVE-2022-0983 |
SQL Injection in Moodle An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the … |
Vulnerable |
|
GHSA-93pj-4p65-qmr9
Aliases: CVE-2022-0334 |
Insufficient user authorization in Moodle A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 … |
Vulnerable |
|
GHSA-9328-7pcw-vw69
Aliases: CVE-2020-1692 |
Cross-Site Request Forgery in Moodle Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled … |
Vulnerable |
|
GHSA-fm6m-fg23-67jq
Aliases: CVE-2021-36568 |
Moodle Cross-site Scripting vulnerability In certain Moodle products after creating a course, it is possible to add in a arbitrary … | There are no reported fixed by versions. |
|
GHSA-4gq2-x5w4-7hp8
Aliases: CVE-2024-43435 |
Moodle has insufficient capability checks A flaw was found in moodle. Insufficient capability checks make it possible for users with … |
Vulnerable |
|
GHSA-c767-4whh-v7rw
Aliases: CVE-2024-43429 |
Moodle has user information visibility control issues in gradebook reports A flaw was found in moodle. Some hidden user profile … |
Vulnerable |
|
GHSA-fhg2-r2h9-h7q8
Aliases: CVE-2024-45690 |
Moodle IDOR when deleting OAuth2 linked accounts A flaw was found in Moodle. Additional checks were required to ensure users … |
Vulnerable |
|
GHSA-vpq5-56jj-vf2m
Aliases: CVE-2024-43427 |
Moodle admin presets export tool includes some secrets that should not be exported A flaw was found in moodle. When … |
Vulnerable |
|
GHSA-v6f4-v8h8-3c87
Aliases: CVE-2024-43425 |
Moodle Remote Code Execution vulnerability A flaw was found in Moodle. Additional restrictions are required to avoid a remote code … |
Vulnerable |
|
GHSA-cq5f-wv7p-5gfc
Aliases: CVE-2024-48896 |
Moodle leaks user names A vulnerability was found in Moodle. It is possible for users with the "send message" capability … |
Vulnerable |
|
GHSA-mx26-62xm-2p83
Aliases: CVE-2024-43436 |
Moodle vulnerable to site administration SQL injection via XMLDB editor A SQL injection risk flaw was found in the XMLDB … |
Vulnerable |
|
GHSA-xfv7-h2qg-rjm7
Aliases: CVE-2024-45691 |
Moodle Lesson activity password bypass through PHP loose comparison A flaw was found in Moodle. When restricting access to a … |
Vulnerable |
|
GHSA-2r9m-wg35-rfvc
Aliases: CVE-2024-43428 |
Moodle vulnerable to cache poisoning via injection into storage To address a cache poisoning risk in Moodle, additional validation for … |
Vulnerable |
|
GHSA-4hjf-6pxr-549h
Aliases: CVE-2024-43437 |
Moodle Cross-site Scripting vulnerability A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result … |
Vulnerable |
|
GHSA-p9cx-f595-h79h
Aliases: CVE-2024-43438 |
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users A flaw was found in Feedback. Bulk messaging in … |
Vulnerable |
|
GHSA-7wmp-2xmx-g6h8
Aliases: CVE-2024-43432 |
Moodle authorization headers preserved between "emulated redirects" A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH … |
Vulnerable |
|
GHSA-x3x9-349x-2485
Aliases: CVE-2024-48897 |
moodle: IDOR in edit/delete RSS feed A vulnerability was found in Moodle. Additional checks are required to ensure users can … |
Vulnerable |
|
GHSA-mg54-p2wj-5ph7
Aliases: CVE-2024-48901 |
moodle: IDOR when fetching report schedules A vulnerability was found in Moodle. Additional checks are required to ensure users can … |
Vulnerable |
|
GHSA-x87r-37q5-mmr8
Aliases: CVE-2024-43434 |
Moodle has CSRF risk in Feedback non-respondents report The bulk message sending feature in Moodle's Feedback module's non-respondents report had … |
Vulnerable |
|
GHSA-vjmm-r9gg-425m
Aliases: CVE-2024-43426 |
Moodle has arbitrary file read risk through pdfTeX A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation … |
Vulnerable |
|
GHSA-qrqv-26gf-xgwh
Aliases: CVE-2024-43440 |
Moodle LFI vulnerability when restoring malformed block backups A flaw was found in moodle. A local file may include risks … |
Vulnerable |
|
GHSA-wwjf-gwrv-wh45
Aliases: CVE-2024-43431 |
Moodle's IDOR in badges allows deletion of arbitrary badges A vulnerability was found in Moodle. Insufficient capability checks made it … |
Vulnerable |
|
GHSA-fjq9-452g-jg3q
Aliases: CVE-2024-48898 |
moodle: Some users can delete audiences of other reports A vulnerability was found in Moodle. Users with access to delete … |
Vulnerable |
|
GHSA-j822-x5gg-5r56
Aliases: CVE-2024-45689 |
Moodle allows users to retrieve information they did not have permission to access A flaw was found in Moodle. Dynamic … |
Vulnerable |
|
GHSA-hjgc-jxjc-8v9j
Aliases: CVE-2024-43439 |
Moodle reflected XSS via H5P error message A flaw was found in moodle. H5P error messages require additional sanitizing to … |
Vulnerable |
|
GHSA-5p2x-8427-9fgp
Aliases: CVE-2024-1439 |
Moodle Improper Access Control vulnerability Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a … | There are no reported fixed by versions. |
|
GHSA-6vjf-48fh-vxxj
Aliases: CVE-2024-25979 |
Improper Handling of Parameters in moodle The URL parameters accepted by forum search were not limited to the allowed parameters. |
Vulnerable |
|
GHSA-487g-3m3v-hjhq
Aliases: CVE-2024-25978 |
Uncontrolled Resource Consumption in moodle Insufficient file size checks resulted in a denial of service risk in the file picker's … |
Vulnerable |
|
GHSA-jfrg-9hpq-9hvp
Aliases: CVE-2024-25981 |
Improper Access Control in moodle Separate Groups mode restrictions were not honored when performing a forum export, which would export … |
Vulnerable |
|
GHSA-9r26-5w88-qhp9
Aliases: CVE-2024-25983 |
Authorization Bypass in moodle Insufficient checks in a web service made it possible to add comments to the comments block … |
Vulnerable |
|
GHSA-7pjp-fm93-p6pj
Aliases: CVE-2024-25982 |
Cross-Site Request Forgery in moodle The link to update all installed language packs did not include the necessary token to … |
Vulnerable |
|
GHSA-cp8m-h777-g4p3
Aliases: CVE-2024-25980 |
Improper Access Control in moodle Separate Groups mode restrictions were not honored in the H5P attempts report, which would display … |
Vulnerable |
|
GHSA-x29x-qwvx-fxr2
Aliases: CVE-2024-38273 |
Moodle BigBlueButton web service leaks meeting joining information Insufficient capability checks meant it was possible for users to gain access … |
Vulnerable |
|
GHSA-p5cg-6rfr-6mx8
Aliases: CVE-2024-38274 |
Moodle stored XSS via calendar's event title when deleting the event Insufficient escaping of calendar event titles resulted in a … |
Vulnerable |
|
GHSA-r82w-3phg-qvr4
Aliases: CVE-2024-38277 |
Moodle uses the same key for QR login and auto-login A unique key should be generated for a user's QR … |
Vulnerable |
|
GHSA-356g-7x36-7m34
Aliases: CVE-2024-38276 |
Moodle CSRF risks due to misuse of confirm_sesskey Incorrect CSRF token checks resulted in multiple CSRF risks. |
Vulnerable |
|
GHSA-p2cj-86v4-7782
Aliases: CVE-2024-38275 |
Moodle HTTP authorization header is preserved between "emulated redirects" The cURL wrapper in Moodle retained the original request headers when … |
Vulnerable |
|
GHSA-xqhh-253w-4q5f
Aliases: CVE-2024-33998 |
Moodle Cross-site Scripting (XSS) Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk … |
Vulnerable |
|
GHSA-jg4f-8w9x-jv35
Aliases: CVE-2024-34003 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-8qwh-4vwv-7c5m
Aliases: CVE-2024-34000 |
Moodle Cross-site Scripting (XSS) ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS … |
Vulnerable |
|
GHSA-q3cm-ccrm-2mr6
Aliases: CVE-2024-34004 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-mm9p-xwfm-3fqf
Aliases: CVE-2024-34002 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-gq9f-8rj4-w7jc
Aliases: CVE-2024-34001 |
Moodle CSRF risk in admin preset tool management of presets Actions in the admin preset tool did not include the … |
Vulnerable |
|
GHSA-r99q-hmqv-xw8w
Aliases: CVE-2024-34005 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-4qww-rxq6-x7gf
Aliases: CVE-2024-33996 |
Moodle broken access control when setting calendar event type Incorrect validation of allowed event types in a calendar web service … |
Vulnerable |
|
GHSA-68x5-4jg5-gjgg
Aliases: CVE-2024-34008 |
Moodle CSRF risk in analytics management of models Actions in the admin management of analytics models did not include the … |
Vulnerable |
|
GHSA-vvh5-7v3m-j3mj
Aliases: CVE-2024-34006 |
Moodle Unsanitized HTML in site log for config_log_created The site log report required additional encoding of event descriptions to ensure … |
Vulnerable |
|
GHSA-9qgq-93c7-9hm4
Aliases: CVE-2024-33997 |
Moodle stored Cross-site Scripting (XSS) Additional sanitizing was required when opening the equation editor to prevent a stored Cross-site Scripting … |
Vulnerable |
|
GHSA-f6mh-79vh-2hv7
Aliases: CVE-2024-28593 |
Cross-site Scripting in Moodle Chat The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A … | There are no reported fixed by versions. |
|
GHSA-3qw5-v9cc-v262
Aliases: CVE-2024-29374 |
Cross site scripting in moodle A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within … | There are no reported fixed by versions. |
|
GHSA-9gqp-3g28-w9xc
Aliases: CVE-2023-5547 |
Moodle Cross-site Scripting vulnerability The course upload preview contained an XSS risk for users uploading unsafe data. |
Vulnerable |
|
GHSA-28gc-4qq5-8q26
Aliases: CVE-2023-5541 |
Moodle Cross-site Scripting vulnerability The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it … |
Vulnerable |
|
GHSA-3xxm-3g3c-w579
Aliases: CVE-2023-5539 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the Lesson activity. By default this was only … |
Vulnerable |
|
GHSA-j5xf-gv89-g422
Aliases: CVE-2023-5544 |
Moodle Cross-site Scripting vulnerability Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential … |
Vulnerable |
|
GHSA-fm5h-58g2-4m3f
Aliases: CVE-2023-5549 |
Moodle Improper Access Control vulnerability Insufficient web service capability checks made it possible to move categories a user had permission … |
Vulnerable |
|
GHSA-jr83-8x65-xcr5
Aliases: CVE-2023-5551 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability Separate Groups mode restrictions were not honoured in the forum … |
Vulnerable |
|
GHSA-26fg-v32r-h663
Aliases: CVE-2023-5545 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability H5P metadata automatically populated the author with the user's username, … |
Vulnerable |
|
GHSA-5cvx-cwpx-9rjh
Aliases: CVE-2023-5550 |
Moodle Code Injection vulnerability In a shared hosting environment that has been misconfigured to allow access to other users' content, … |
Vulnerable |
|
GHSA-cwh2-q44x-5w3c
Aliases: CVE-2023-5548 |
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability Stronger revision number limitations were required on file serving endpoints … |
Vulnerable |
|
GHSA-8mm2-m2gp-c6x2
Aliases: CVE-2023-5542 |
Moodle Improper Access Control vulnerability Students in "Only see own membership" groups could see other students in the group, which … |
Vulnerable |
|
GHSA-w8x2-w4qr-v3x4
Aliases: CVE-2023-5540 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the IMSCP activity. By default this was only … |
Vulnerable |
|
GHSA-9724-h8p7-r3jv
Aliases: CVE-2023-5546 |
Moodle Cross-site Scripting vulnerability ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS … |
Vulnerable |
|
GHSA-97qf-pq7x-964m
Aliases: CVE-2023-23921 |
Moodle Cross-site Scripting vulnerability The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some … |
Vulnerable |
|
GHSA-32jc-9p58-p82x
Aliases: CVE-2023-23923 |
Moodle Improper Access Control vulnerability The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" … |
Vulnerable |
|
GHSA-fwfj-8p36-rc64
Aliases: CVE-2023-35131 |
Moodle vulnerable to Cross-site Scripting Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw … |
Vulnerable |
|
GHSA-xxp4-mf4h-6cwm
Aliases: CVE-2023-35133 |
Moodle vulnerable to Server Side Request Forgery An issue in the logic used to check 0.0.0.0 against the cURL blocked … |
Vulnerable |
|
GHSA-49mv-vfcp-8gg9
Aliases: CVE-2023-35132 |
Moodle vulnerable to SQL Injection A limited SQL injection risk was identified on the Mnet SSO access control page. This … |
Vulnerable |
|
GHSA-7mmc-22g7-3xq2
Aliases: CVE-2023-30944 |
Moodle SQL Injection vulnerability The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external … |
Vulnerable |
|
GHSA-22gj-8qj2-fj46
Aliases: CVE-2023-30943 |
Moodle External Control of File Name or Path vulnerability The vulnerability was found Moodle which exists because the application allows … |
Vulnerable |
|
GHSA-w2pm-fr62-jgv4
Aliases: CVE-2021-27131 |
Moodle vulnerable to stored Cross-site Scripting Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input … | There are no reported fixed by versions. |
|
GHSA-948f-j464-rfj2
Aliases: CVE-2022-40208 |
Moodle may allow students to bypass sequential navigation during a quiz attempt In Moodle, insufficient limitations in some quiz web … |
Vulnerable |
|
GHSA-prjm-2fj2-787f
Aliases: CVE-2023-28336 |
Moodle may allow teachers to access the names of users they could not otherwise access Insufficient filtering of grade report … |
Vulnerable |
|
GHSA-79jp-m64f-pgrc
Aliases: CVE-2021-36399 |
Moodle Cross-site Scripting vulnerability In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a … |
Vulnerable |
|
GHSA-qc86-vgf2-6fq6
Aliases: CVE-2021-36392 |
Moodle SQL Injection vulnerability In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. |
Vulnerable |
|
GHSA-g6h6-4fp6-w33w
Aliases: CVE-2021-36401 |
Moodle vulnerable to Stored Cross-site Scripting In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent … |
Vulnerable |
|
GHSA-273w-7fxj-pcp6
Aliases: CVE-2021-36395 |
Moodle vulnerable to Uncontrolled Resource Consumption In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the … |
Vulnerable |
|
GHSA-77jm-f3vj-xvx2
Aliases: CVE-2023-28331 |
Moodle vulnerable to Cross-site Scripting Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. |
Vulnerable |
|
GHSA-35wf-3wq2-r3hx
Aliases: CVE-2021-36400 |
Moodle has Incorrect Default Permissions In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. |
Vulnerable |
|
GHSA-q2x3-2f9g-h559
Aliases: CVE-2023-28333 |
Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input The Mustache pix helper contained … |
Vulnerable |
|
GHSA-72w2-j52c-7682
Aliases: CVE-2023-28329 |
Moodle SQL Injection vulnerability Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only … |
Vulnerable |
|
GHSA-56r9-72vx-q989
Aliases: CVE-2023-28330 |
Moodle arbitrary file read vulnerability Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access … |
Vulnerable |
|
GHSA-vj5p-fp42-774p
Aliases: CVE-2023-1402 |
Moodle may display roles to users who don't have access to them The course participation report required additional checks to … |
Vulnerable |
|
GHSA-j9cw-5cpj-9qj5
Aliases: CVE-2021-36403 |
Moodle has a Hidden Functionality vulnerability In Moodle, in some circumstances, email notifications of messages could have the link back … |
Vulnerable |
|
GHSA-f46j-r7q3-6cm2
Aliases: CVE-2021-36393 |
Moodle SQL Injection vulnerability In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. |
Vulnerable |
|
GHSA-2wmj-8mqg-r9q8
Aliases: CVE-2021-36397 |
Moodle has Incorrect Default Permissions In Moodle, insufficient capability checks meant message deletions were not limited to the current user. |
Vulnerable |
|
GHSA-9f45-9qrw-pp4v
Aliases: CVE-2023-28332 |
Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional If the algebra filter was enabled but not … |
Vulnerable |
|
GHSA-2563-fp9c-mgm8
Aliases: CVE-2021-36394 |
Moodle Session Fixation vulnerability In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
Vulnerable |
|
GHSA-4rmj-w58m-fvch
Aliases: CVE-2021-36396 |
Moodle vulnerable to Server-Side Request Forgery In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed … |
Vulnerable |
|
GHSA-gv8f-43pg-c5qw
Aliases: CVE-2021-36402 |
Moodle Improper Input Validation vulnerability In affected versions of Moodle, users' names require additional sanitizing in the account confirmation email, … |
Vulnerable |
|
GHSA-hh52-g5c4-wprh
Aliases: CVE-2023-28334 |
Moodle may allow authenticated users to enumerate other user's names via learning plans page Authenticated users were able to enumerate … |
Vulnerable |
|
GHSA-mhf6-pp52-8wqj
Aliases: CVE-2025-67849 |
Moodle Cross-site Scripting (XSS) vulnerability A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization … |
Vulnerable |
|
GHSA-j5jv-w5cw-j9ff
Aliases: CVE-2025-67848 |
Moodle authentication bypass vulnerability A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through … |
Vulnerable |
|
GHSA-cg8j-5cr2-568q
Aliases: CVE-2026-26047 |
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits A Denial of Service vulnerability was … |
Not vulnerable |
|
GHSA-5cx4-w4fh-fr57
Aliases: CVE-2025-67853 |
Moodle Affected by Improper Restriction of Excessive Authentication Attempts A flaw was found in Moodle. A remote attacker could exploit … |
Vulnerable |
|
GHSA-vwhw-vp9v-q9c9
Aliases: CVE-2025-67855 |
Moodle vulnerable to Cross-site Scripting A flaw was found in Moodle. A remote attacker could exploit a reflected Cross-Site Scripting … |
Vulnerable |
|
GHSA-qv78-6gpp-hm68
Aliases: CVE-2025-67852 |
Moodle Open Redirect vulnerability A flaw was found in Moodle. An Open Redirect vulnerability in the OAuth login flow allows … |
Vulnerable |
|
GHSA-hcm6-q6pc-xfhm
Aliases: CVE-2025-67856 |
Moodle has an authorization logic flaw A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete … |
Vulnerable |
|
GHSA-qfh6-h7j6-fvjv
Aliases: CVE-2025-67851 |
Moodle formula injection vulnerability A flaw was found in Moodle. This formula injection vulnerability occurs when data fields are exported … |
Vulnerable |
|
GHSA-8jrv-wx83-w3xj
Aliases: CVE-2025-67857 |
Moodle Inserts Sensitive Information Into Sent Data A flaw was found in moodle. During anonymous assignment submissions, user identifiers were … |
Vulnerable |
|
GHSA-6mmv-f6c6-v6q8
Aliases: CVE-2025-67850 |
Moodle vulnerable to Cross-site Scripting A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due … |
Vulnerable |
|
GHSA-ggxq-2mg9-8966
Aliases: CVE-2026-26045 |
Moodle has a Remote Code Execution risk via file restore A flaw was identified in Moodle’s backup restore functionality where … |
Not vulnerable |
|
GHSA-xvmh-25jw-gmmm
Aliases: CVE-2025-67847 |
Moodle affected by a code injection vulnerability A flaw was found in Moodle. An attacker with access to the restore … |
Vulnerable |
|
CVE-2016-7038
|
Weak Password Recovery Mechanism for Forgotten Password In Moodle, web service tokens are not invalidated when the user password is … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-0334
|
Exposure of Resource to Wrong Sphere Insufficient capability checks could lead to users accessing their grade report for courses where … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-43560
|
Exposure of Resource to Wrong Sphere Insufficient capability checks made it possible to fetch other users' calendar action events. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-2153
|
Cross-site Scripting Cross-site scripting (XSS) vulnerability in the `advanced-search` feature in `mod_data` in Moodle allows remote attackers to inject arbitrary … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-18210
|
Cross-site Scripting Persistent XSS in `/course/modedit.php` of Moodle allows authenticated users (Teacher) to inject JavaScript into the session of another … |
Vulnerable |
|
CVE-2021-32473
|
Exposure of Sensitive Information to an Unauthorized Actor It was possible for a student to view their quiz grade before … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-0985
|
Improper Authentication Insufficient capability checks could allow users with the `moodle/site:uploadusers` capability to delete users, without having the necessary `moodle/user:delete` … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2016-5013
|
Injection Vulnerability In Moodle, text injection can occur in email headers, potentially leading to outbound spam. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-10154
|
Improper Access Control A web service fetching messages was not restricted to the current user's conversations. |
Vulnerable |
|
CVE-2021-40691
|
Improper Authentication A session hijack risk was identified in the Shibboleth authentication plugin. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2023-35132
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') A limited SQL injection risk was identified on … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-20186
|
Cross-site Scripting It was found in Moodle that if the TeX notation filter was enabled, additional sanitizing of TeX content … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1045
|
Cross-site Scripting Moodle is vulnerable to XSS via a calendar event name. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2023-35133
|
Server-Side Request Forgery (SSRF) An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-32474
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') An SQL injection risk existed on sites with … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-10187
|
Improper Access Control Users with permission to delete entries from a glossary were able to delete entries from other glossaries … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2018-14630
|
Code Injection Moodle is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3850
|
URL Redirection to Untrusted Site (Open Redirect) Links within assignment submission comments would open directly (in the same window). Although … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3810
|
Information Exposure The `/userpix/` page did not escape users' full names, which are included as text when hovering over profile … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-40693
|
Improper Authentication An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2022-0335
|
Cross-Site Request Forgery (CSRF) The `delete badge alignment` functionality does not include the necessary token check to prevent a CSRF … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2016-2152
|
Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in `auth/db/auth.php` in Moodle allow remote attackers to inject arbitrary web script or … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1081
|
Improper Access Control Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-10186
|
Cross-Site Request Forgery (CSRF) A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1044
|
Information Exposure In Moodle, the quiz web services allow students to see quiz results when it is prohibited in the … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3848
|
Information Exposure Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-40694
|
Improper Encoding or Escaping of Output Insufficient escaping of the LaTeX preamble made it possible for site administrators to read … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2022-0333
|
Incorrect Authorization The `calendar:manageentries` capability allowed managers to access or modify any calendar event, but should have been restricted from … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2016-9187
|
Unrestricted Upload of File with Dangerous Type Unrestricted file upload vulnerability in the double extension support in the "image" module … |
Vulnerable |
|
CVE-2021-20183
|
Cross-site Scripting It was found in Moodle that some search inputs were vulnerable to reflected XSS due to insufficient escaping … |
Vulnerable |
|
CVE-2018-1042
|
Server-Side Request Forgery (SSRF) Moodle has Server Side Request Forgery in the `filepicker`. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3847
|
Improper Input Validation Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-16854
|
Cross-Site Request Forgery (CSRF) The login form is not protected by a token to prevent login cross-site request forgery. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-32475
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') ID numbers displayed in the quiz grading report required additional … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-43559
|
Cross-Site Request Forgery (CSRF) The `delete related badge` functionality does not include the necessary token check to prevent a CSRF … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-2576
|
Improper Input Validation There is incorrect sanitization of attributes in forums. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-20187
|
Code Injection It was found in Moodle that it was possible for site administrators to execute arbitrary PHP scripts via … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-32476
|
Uncontrolled Resource Consumption A denial-of-service risk was identified in the draft files area, due to it not respecting user file … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-32478
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The redirect URI in the LTI authorization endpoint required extra … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-20184
|
Improper Validation of Integrity Check Value It was found in Moodle that a insufficient capability checks in some grade related … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2017-15110
|
Information Exposure Students can find out email addresses of other students in the same course. Using search on the Participants … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2016-2159
|
Improper Access Control The `save_submission` function in `mod/assign/externallib.php` in Moodle allows remote authenticated users to bypass intended due-date restrictions by … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-58fm-v4pr-jh8p
Aliases: CVE-2016-9187 |
Moodle Unrestricted file upload vulnerability Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle … | There are no reported fixed by versions. |
|
GHSA-r867-v437-4rrm
Aliases: CVE-2016-3734 |
Moodle Cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through … |
Vulnerable Vulnerable |
|
GHSA-h7xp-7fjp-ghhc
Aliases: CVE-2019-10189 |
moodle Improper Access Control A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group … |
Vulnerable Vulnerable |
|
GHSA-h8vc-v44p-5r2q
Aliases: CVE-2016-2156 |
Moodle provides calendar-event data without considering whether an activity is hidden calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x … |
Vulnerable Vulnerable |
|
GHSA-w2pj-r8m3-r4jc
Aliases: CVE-2017-7531 |
Moodle Information Disclosure In Moodle 3.3, the course overview block reveals activities in hidden courses. |
Vulnerable Vulnerable |
|
GHSA-h34c-px28-rjgw
Aliases: CVE-2015-5268 |
Moodle mishandles group-based authorization checks The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x … |
Vulnerable Vulnerable |
|
GHSA-c2r4-f8qv-2v7v
Aliases: CVE-2015-5341 |
Moodle allows attackers to read SCORM contents mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x … |
Vulnerable Vulnerable |
|
GHSA-r9pc-g29w-f86j
Aliases: CVE-2016-2190 |
Moodle sensitive information disclosure Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 … | There are no reported fixed by versions. |
|
GHSA-grvw-qq2j-r898
Aliases: CVE-2015-5336 |
Moodle multiple cross-site scripting (XSS) vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x … |
Vulnerable Vulnerable |
|
GHSA-92q5-2h76-vgmj
Aliases: CVE-2019-10188 |
moodle Improper Access Control A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group … |
Vulnerable Vulnerable |
|
GHSA-c3pr-h96w-2jjg
Aliases: CVE-2018-14630 |
Moodle XML import of ddwtos could lead to intentional remote code execution moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is … |
Vulnerable Vulnerable |
|
GHSA-f5pm-c4cw-563p
Aliases: CVE-2016-2157 |
Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, … |
Vulnerable Vulnerable |
|
GHSA-gmhr-6f43-7qpj
Aliases: CVE-2015-5339 |
Moodle does not properly implement group-based access restrictions The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before … |
Vulnerable Vulnerable |
|
GHSA-jjhx-5jff-rc8m
Aliases: CVE-2017-7532 |
Moodle Improper Privilege Management In Moodle 3.x, course creators are able to change system default settings for courses. |
Vulnerable Vulnerable |
|
GHSA-r3fc-hx6q-g6cq
Aliases: CVE-2016-2151 |
Moodle allows attackers to discover student e-mail addresses user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x … |
Vulnerable Vulnerable |
|
GHSA-v33x-q8gh-4x42
Aliases: CVE-2015-5338 |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through … |
Vulnerable Vulnerable |
|
GHSA-hjrj-7wcj-7j3c
Aliases: CVE-2016-0724 |
Moodle sensitive information disclosure The (1) `core_enrol_get_course_enrolment_methods` and (2) `enrol_self_get_instance_info` web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x … | There are no reported fixed by versions. |
|
GHSA-382v-gxj9-ffhc
Aliases: CVE-2015-5267 |
Moodle uses predictable password-recovery tokens lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 … |
Vulnerable Vulnerable |
|
GHSA-6xpm-q8x9-j3rw
Aliases: CVE-2015-5342 |
Moodle allows attackers to bypass intended access restrictions The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before … |
Vulnerable Vulnerable |
|
GHSA-2hw6-6rgf-726v
Aliases: CVE-2015-5337 |
Moodle XSS Vulnerability Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict … | There are no reported fixed by versions. |
|
GHSA-m882-j7gq-v9p7
Aliases: CVE-2016-2158 |
Moodle allows attackers to obtain sensitive category-detail information lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x … |
Vulnerable Vulnerable |
|
GHSA-7ghm-fp7p-qvjq
Aliases: CVE-2016-9188 |
Moodle XSS Vulnerability Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary … | There are no reported fixed by versions. |
|
GHSA-mmvj-j7hq-rx85
Aliases: CVE-2015-5340 |
Moodle sensitive information disclosure Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider … | There are no reported fixed by versions. |
|
GHSA-3fj7-9j8m-7r8g
Aliases: CVE-2019-3850 |
Moodle Stored HTML in assignment submission comments allowed links to be opened directly A vulnerability was found in moodle before … |
Vulnerable Vulnerable |
|
GHSA-5729-822w-j342
Aliases: CVE-2015-5269 |
Moodle cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before … |
Vulnerable Vulnerable |
|
GHSA-hpmv-wvq3-gj27
Aliases: CVE-2015-5335 |
Moodle cross-site request forgery (CSRF) vulnerability Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, … |
Vulnerable Vulnerable |
|
CVE-2023-5549
Aliases: GHSA-fm5h-58g2-4m3f |
Moodle Improper Access Control vulnerability Insufficient web service capability checks made it possible to move categories a user had permission … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-5550
Aliases: GHSA-5cvx-cwpx-9rjh |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') In a shared hosting environment that has … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-5539
Aliases: GHSA-3xxm-3g3c-w579 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A remote code execution risk was identified … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-5540
Aliases: GHSA-w8x2-w4qr-v3x4 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A remote code execution risk was identified … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-5548
Aliases: GHSA-cwh2-q44x-5w3c |
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability Stronger revision number limitations were required on file serving endpoints … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-5551
Aliases: GHSA-jr83-8x65-xcr5 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability Separate Groups mode restrictions were not honoured in the forum … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-9188
Aliases: GHSA-7ghm-fp7p-qvjq |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before … |
Vulnerable Vulnerable |
|
CVE-2021-43558
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A URL parameter in the filetype site administrator tool requires … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-5545
Aliases: GHSA-26fg-v32r-h663 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability H5P metadata automatically populated the author with the user's username, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-9vc3-vm42-fjhm
Aliases: CVE-2025-3637 |
Moodle's mod_data edit/delete pages pass CSRF token in GET parameter A security vulnerability was found in Moodle where confidential information … |
Vulnerable Vulnerable |
|
GHSA-7mfw-g8x4-rq2w
Aliases: CVE-2017-12156 |
Moodle XSS Vulnerability Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-x5hj-47vv-53p8
Aliases: CVE-2013-4940 |
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, … |
Vulnerable Vulnerable |
|
GHSA-gw95-48xq-gqf9
Aliases: CVE-2017-12157 |
Moodle sensitive information disclosure In Moodle 3.x, various course reports allow teachers to view details about users in the groups … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-27j2-c838-c3qg
Aliases: CVE-2014-3543 |
Moodle Arbitrary File Read via XML External Entity vulnerability `mod/imscp/locallib.php` in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-4r2p-wpv5-683w
Aliases: CVE-2019-3808 |
Moodle XSS Vulnerability A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-5xp2-rv4h-mm2q
Aliases: CVE-2019-10133 |
Moodle Open Redirect Vulnerability A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-x3x8-fjw6-hccx
|
Moodle does not consider "don't send" attributes during hub registration Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and … |
CVE-2013-2081
|
|
GHSA-wmmc-qjq2-vvm2
|
Moodle is vulnerable to Sensitive Information Disclosure The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before … |
CVE-2013-2080
|
|
GHSA-wp3g-pr4h-q6vv
|
Moodle does not enforce capability requirements for reading blog comments Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and … |
CVE-2013-2082
|
|
GHSA-m63h-q4x3-6hwj
|
Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class The MoodleQuickForm class in `lib/formslib.php` in Moodle through 2.1.10, 2.2.x … |
CVE-2013-2083
|
|
CVE-2013-2083
|
Improper Input Validation The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x … |
GHSA-m63h-q4x3-6hwj
|
|
CVE-2013-2080
|
Moodle is vulnerable to Sensitive Information Disclosure The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before … |
GHSA-wmmc-qjq2-vvm2
|