Search for packages
| purl | pkg:composer/moodle/moodle@4.1.18 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-w29j-8phw-ffjf
Aliases: CVE-2025-62401 |
Moodle has a time restriction bypass An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, … |
Vulnerable |
|
GHSA-m58f-9pvv-8mp2
Aliases: CVE-2025-62399 |
Moodle vulnerable to brute-force password guesses Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, … |
Vulnerable |
|
GHSA-422v-w6c5-vq42
Aliases: CVE-2025-62400 |
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view … |
Vulnerable |
|
GHSA-5p2x-8427-9fgp
Aliases: CVE-2024-1439 |
Moodle Improper Access Control vulnerability Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a … | There are no reported fixed by versions. |
|
GHSA-f6mh-79vh-2hv7
Aliases: CVE-2024-28593 |
Cross-site Scripting in Moodle Chat The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A … | There are no reported fixed by versions. |
|
GHSA-9gqp-3g28-w9xc
Aliases: CVE-2023-5547 |
Moodle Cross-site Scripting vulnerability The course upload preview contained an XSS risk for users uploading unsafe data. |
Vulnerable |
|
GHSA-28gc-4qq5-8q26
Aliases: CVE-2023-5541 |
Moodle Cross-site Scripting vulnerability The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it … |
Vulnerable |
|
GHSA-3xxm-3g3c-w579
Aliases: CVE-2023-5539 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the Lesson activity. By default this was only … |
Vulnerable |
|
GHSA-j5xf-gv89-g422
Aliases: CVE-2023-5544 |
Moodle Cross-site Scripting vulnerability Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential … |
Vulnerable |
|
GHSA-fm5h-58g2-4m3f
Aliases: CVE-2023-5549 |
Moodle Improper Access Control vulnerability Insufficient web service capability checks made it possible to move categories a user had permission … |
Vulnerable |
|
GHSA-26fg-v32r-h663
Aliases: CVE-2023-5545 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability H5P metadata automatically populated the author with the user's username, … |
Vulnerable |
|
GHSA-cwh2-q44x-5w3c
Aliases: CVE-2023-5548 |
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability Stronger revision number limitations were required on file serving endpoints … |
Vulnerable |
|
GHSA-8mm2-m2gp-c6x2
Aliases: CVE-2023-5542 |
Moodle Improper Access Control vulnerability Students in "Only see own membership" groups could see other students in the group, which … |
Vulnerable |
|
GHSA-w8x2-w4qr-v3x4
Aliases: CVE-2023-5540 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the IMSCP activity. By default this was only … |
Vulnerable |
|
GHSA-9724-h8p7-r3jv
Aliases: CVE-2023-5546 |
Moodle Cross-site Scripting vulnerability ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS … |
Vulnerable |
|
GHSA-7mmc-22g7-3xq2
Aliases: CVE-2023-30944 |
Moodle SQL Injection vulnerability The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external … |
Vulnerable |
|
GHSA-22gj-8qj2-fj46
Aliases: CVE-2023-30943 |
Moodle External Control of File Name or Path vulnerability The vulnerability was found Moodle which exists because the application allows … |
Vulnerable |
|
GHSA-mhf6-pp52-8wqj
Aliases: CVE-2025-67849 |
Moodle Cross-site Scripting (XSS) vulnerability A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization … |
Vulnerable |
|
GHSA-j5jv-w5cw-j9ff
Aliases: CVE-2025-67848 |
Moodle authentication bypass vulnerability A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through … |
Vulnerable |
|
GHSA-cg8j-5cr2-568q
Aliases: CVE-2026-26047 |
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits A Denial of Service vulnerability was … |
Not vulnerable |
|
GHSA-5cx4-w4fh-fr57
Aliases: CVE-2025-67853 |
Moodle Affected by Improper Restriction of Excessive Authentication Attempts A flaw was found in Moodle. A remote attacker could exploit … |
Vulnerable |
|
GHSA-vwhw-vp9v-q9c9
Aliases: CVE-2025-67855 |
Moodle vulnerable to Cross-site Scripting A flaw was found in Moodle. A remote attacker could exploit a reflected Cross-Site Scripting … |
Vulnerable |
|
GHSA-qv78-6gpp-hm68
Aliases: CVE-2025-67852 |
Moodle Open Redirect vulnerability A flaw was found in Moodle. An Open Redirect vulnerability in the OAuth login flow allows … |
Vulnerable |
|
GHSA-hcm6-q6pc-xfhm
Aliases: CVE-2025-67856 |
Moodle has an authorization logic flaw A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete … |
Vulnerable |
|
GHSA-qfh6-h7j6-fvjv
Aliases: CVE-2025-67851 |
Moodle formula injection vulnerability A flaw was found in Moodle. This formula injection vulnerability occurs when data fields are exported … |
Vulnerable |
|
GHSA-8jrv-wx83-w3xj
Aliases: CVE-2025-67857 |
Moodle Inserts Sensitive Information Into Sent Data A flaw was found in moodle. During anonymous assignment submissions, user identifiers were … |
Vulnerable |
|
GHSA-6mmv-f6c6-v6q8
Aliases: CVE-2025-67850 |
Moodle vulnerable to Cross-site Scripting A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due … |
Vulnerable |
|
GHSA-ggxq-2mg9-8966
Aliases: CVE-2026-26045 |
Moodle has a Remote Code Execution risk via file restore A flaw was identified in Moodle’s backup restore functionality where … |
Not vulnerable |
|
GHSA-xvmh-25jw-gmmm
Aliases: CVE-2025-67847 |
Moodle affected by a code injection vulnerability A flaw was found in Moodle. An attacker with access to the restore … |
Vulnerable |
|
GHSA-9vc3-vm42-fjhm
Aliases: CVE-2025-3637 |
Moodle's mod_data edit/delete pages pass CSRF token in GET parameter A security vulnerability was found in Moodle where confidential information … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-cpm7-mv33-jwf8
|
Moodle's AJAX section delete does not respect course_can_delete_section() A flaw was found in Moodle. Additional checks were required to prevent … |
CVE-2025-3644
|
|
GHSA-88xj-97gf-7wpq
|
Moodle has a CSRF risk in user tours manager that allows tour duplication A security vulnerability was discovered in Moodle … |
CVE-2025-3635
|
|
GHSA-chmf-m33p-ph8m
|
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds A flaw was found in Moodle. This … |
CVE-2025-3636
|
|
GHSA-hxgg-4qww-85ph
|
Moodle has reflected Cross-site Scripting risk in policy tool A flaw was found in Moodle. The return URL in the … |
CVE-2025-3643
|
|
GHSA-m8qh-hx4c-h9hr
|
Moodle has a CSRF risk in Brickfield tool's analysis request action A flaw was found in Moodle. The analysis request … |
CVE-2025-3638
|
|
GHSA-34g7-pg9j-pxgp
|
Moodle allows IDOR when accessing the cohorts report A flaw was discovered in Moodle. Additional checks were required to ensure … |
CVE-2025-3647
|
|
GHSA-pj96-xh2w-fgqx
|
Moodle has an IDOR in messaging web service which allows access to some user details A flaw was found in … |
CVE-2025-3645
|
|
GHSA-m367-445c-2xqr
|
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository A flaw was found in Moodle. … |
CVE-2025-3642
|
|
GHSA-c8v6-vxhf-wcrr
|
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository A flaw was found in Moodle. … |
CVE-2025-3641
|
|
GHSA-6g5x-h5x7-q4mq
|
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other … |
CVE-2025-3640
|