Search for packages
| purl | pkg:composer/moodle/moodle@4.2.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-w29j-8phw-ffjf
Aliases: CVE-2025-62401 |
Moodle has a time restriction bypass An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, … |
Vulnerable |
|
GHSA-m58f-9pvv-8mp2
Aliases: CVE-2025-62399 |
Moodle vulnerable to brute-force password guesses Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, … |
Vulnerable |
|
GHSA-422v-w6c5-vq42
Aliases: CVE-2025-62400 |
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view … |
Vulnerable |
|
GHSA-4gq2-x5w4-7hp8
Aliases: CVE-2024-43435 |
Moodle has insufficient capability checks A flaw was found in moodle. Insufficient capability checks make it possible for users with … |
Vulnerable |
|
GHSA-c767-4whh-v7rw
Aliases: CVE-2024-43429 |
Moodle has user information visibility control issues in gradebook reports A flaw was found in moodle. Some hidden user profile … |
Vulnerable |
|
GHSA-fhg2-r2h9-h7q8
Aliases: CVE-2024-45690 |
Moodle IDOR when deleting OAuth2 linked accounts A flaw was found in Moodle. Additional checks were required to ensure users … |
Vulnerable |
|
GHSA-vpq5-56jj-vf2m
Aliases: CVE-2024-43427 |
Moodle admin presets export tool includes some secrets that should not be exported A flaw was found in moodle. When … |
Vulnerable |
|
GHSA-v6f4-v8h8-3c87
Aliases: CVE-2024-43425 |
Moodle Remote Code Execution vulnerability A flaw was found in Moodle. Additional restrictions are required to avoid a remote code … |
Vulnerable |
|
GHSA-cq5f-wv7p-5gfc
Aliases: CVE-2024-48896 |
Moodle leaks user names A vulnerability was found in Moodle. It is possible for users with the "send message" capability … |
Vulnerable |
|
GHSA-mx26-62xm-2p83
Aliases: CVE-2024-43436 |
Moodle vulnerable to site administration SQL injection via XMLDB editor A SQL injection risk flaw was found in the XMLDB … |
Vulnerable |
|
GHSA-xfv7-h2qg-rjm7
Aliases: CVE-2024-45691 |
Moodle Lesson activity password bypass through PHP loose comparison A flaw was found in Moodle. When restricting access to a … |
Vulnerable |
|
GHSA-2r9m-wg35-rfvc
Aliases: CVE-2024-43428 |
Moodle vulnerable to cache poisoning via injection into storage To address a cache poisoning risk in Moodle, additional validation for … |
Vulnerable |
|
GHSA-4hjf-6pxr-549h
Aliases: CVE-2024-43437 |
Moodle Cross-site Scripting vulnerability A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result … |
Vulnerable |
|
GHSA-p9cx-f595-h79h
Aliases: CVE-2024-43438 |
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users A flaw was found in Feedback. Bulk messaging in … |
Vulnerable |
|
GHSA-7wmp-2xmx-g6h8
Aliases: CVE-2024-43432 |
Moodle authorization headers preserved between "emulated redirects" A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH … |
Vulnerable |
|
GHSA-x3x9-349x-2485
Aliases: CVE-2024-48897 |
moodle: IDOR in edit/delete RSS feed A vulnerability was found in Moodle. Additional checks are required to ensure users can … |
Vulnerable |
|
GHSA-mg54-p2wj-5ph7
Aliases: CVE-2024-48901 |
moodle: IDOR when fetching report schedules A vulnerability was found in Moodle. Additional checks are required to ensure users can … |
Vulnerable |
|
GHSA-x87r-37q5-mmr8
Aliases: CVE-2024-43434 |
Moodle has CSRF risk in Feedback non-respondents report The bulk message sending feature in Moodle's Feedback module's non-respondents report had … |
Vulnerable |
|
GHSA-vjmm-r9gg-425m
Aliases: CVE-2024-43426 |
Moodle has arbitrary file read risk through pdfTeX A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation … |
Vulnerable |
|
GHSA-qrqv-26gf-xgwh
Aliases: CVE-2024-43440 |
Moodle LFI vulnerability when restoring malformed block backups A flaw was found in moodle. A local file may include risks … |
Vulnerable |
|
GHSA-wwjf-gwrv-wh45
Aliases: CVE-2024-43431 |
Moodle's IDOR in badges allows deletion of arbitrary badges A vulnerability was found in Moodle. Insufficient capability checks made it … |
Vulnerable |
|
GHSA-fjq9-452g-jg3q
Aliases: CVE-2024-48898 |
moodle: Some users can delete audiences of other reports A vulnerability was found in Moodle. Users with access to delete … |
Vulnerable |
|
GHSA-j822-x5gg-5r56
Aliases: CVE-2024-45689 |
Moodle allows users to retrieve information they did not have permission to access A flaw was found in Moodle. Dynamic … |
Vulnerable |
|
GHSA-hjgc-jxjc-8v9j
Aliases: CVE-2024-43439 |
Moodle reflected XSS via H5P error message A flaw was found in moodle. H5P error messages require additional sanitizing to … |
Vulnerable |
|
GHSA-6vjf-48fh-vxxj
Aliases: CVE-2024-25979 |
Improper Handling of Parameters in moodle The URL parameters accepted by forum search were not limited to the allowed parameters. |
Vulnerable |
|
GHSA-487g-3m3v-hjhq
Aliases: CVE-2024-25978 |
Uncontrolled Resource Consumption in moodle Insufficient file size checks resulted in a denial of service risk in the file picker's … |
Vulnerable |
|
GHSA-jfrg-9hpq-9hvp
Aliases: CVE-2024-25981 |
Improper Access Control in moodle Separate Groups mode restrictions were not honored when performing a forum export, which would export … |
Vulnerable |
|
GHSA-9r26-5w88-qhp9
Aliases: CVE-2024-25983 |
Authorization Bypass in moodle Insufficient checks in a web service made it possible to add comments to the comments block … |
Vulnerable |
|
GHSA-7pjp-fm93-p6pj
Aliases: CVE-2024-25982 |
Cross-Site Request Forgery in moodle The link to update all installed language packs did not include the necessary token to … |
Vulnerable |
|
GHSA-cp8m-h777-g4p3
Aliases: CVE-2024-25980 |
Improper Access Control in moodle Separate Groups mode restrictions were not honored in the H5P attempts report, which would display … |
Vulnerable |
|
GHSA-x29x-qwvx-fxr2
Aliases: CVE-2024-38273 |
Moodle BigBlueButton web service leaks meeting joining information Insufficient capability checks meant it was possible for users to gain access … |
Vulnerable |
|
GHSA-p5cg-6rfr-6mx8
Aliases: CVE-2024-38274 |
Moodle stored XSS via calendar's event title when deleting the event Insufficient escaping of calendar event titles resulted in a … |
Vulnerable |
|
GHSA-r82w-3phg-qvr4
Aliases: CVE-2024-38277 |
Moodle uses the same key for QR login and auto-login A unique key should be generated for a user's QR … |
Vulnerable |
|
GHSA-356g-7x36-7m34
Aliases: CVE-2024-38276 |
Moodle CSRF risks due to misuse of confirm_sesskey Incorrect CSRF token checks resulted in multiple CSRF risks. |
Vulnerable |
|
GHSA-p2cj-86v4-7782
Aliases: CVE-2024-38275 |
Moodle HTTP authorization header is preserved between "emulated redirects" The cURL wrapper in Moodle retained the original request headers when … |
Vulnerable |
|
GHSA-xqhh-253w-4q5f
Aliases: CVE-2024-33998 |
Moodle Cross-site Scripting (XSS) Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk … |
Vulnerable |
|
GHSA-jg4f-8w9x-jv35
Aliases: CVE-2024-34003 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-8qwh-4vwv-7c5m
Aliases: CVE-2024-34000 |
Moodle Cross-site Scripting (XSS) ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS … |
Vulnerable |
|
GHSA-q3cm-ccrm-2mr6
Aliases: CVE-2024-34004 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-mm9p-xwfm-3fqf
Aliases: CVE-2024-34002 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-gq9f-8rj4-w7jc
Aliases: CVE-2024-34001 |
Moodle CSRF risk in admin preset tool management of presets Actions in the admin preset tool did not include the … |
Vulnerable |
|
GHSA-r99q-hmqv-xw8w
Aliases: CVE-2024-34005 |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments In a shared hosting environment that has been misconfigured to … |
Vulnerable |
|
GHSA-4qww-rxq6-x7gf
Aliases: CVE-2024-33996 |
Moodle broken access control when setting calendar event type Incorrect validation of allowed event types in a calendar web service … |
Vulnerable |
|
GHSA-68x5-4jg5-gjgg
Aliases: CVE-2024-34008 |
Moodle CSRF risk in analytics management of models Actions in the admin management of analytics models did not include the … |
Vulnerable |
|
GHSA-vvh5-7v3m-j3mj
Aliases: CVE-2024-34006 |
Moodle Unsanitized HTML in site log for config_log_created The site log report required additional encoding of event descriptions to ensure … |
Vulnerable |
|
GHSA-9qgq-93c7-9hm4
Aliases: CVE-2024-33997 |
Moodle stored Cross-site Scripting (XSS) Additional sanitizing was required when opening the equation editor to prevent a stored Cross-site Scripting … |
Vulnerable |
|
GHSA-f6mh-79vh-2hv7
Aliases: CVE-2024-28593 |
Cross-site Scripting in Moodle Chat The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A … | There are no reported fixed by versions. |
|
GHSA-9gqp-3g28-w9xc
Aliases: CVE-2023-5547 |
Moodle Cross-site Scripting vulnerability The course upload preview contained an XSS risk for users uploading unsafe data. |
Vulnerable |
|
GHSA-28gc-4qq5-8q26
Aliases: CVE-2023-5541 |
Moodle Cross-site Scripting vulnerability The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it … |
Vulnerable |
|
GHSA-3xxm-3g3c-w579
Aliases: CVE-2023-5539 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the Lesson activity. By default this was only … |
Vulnerable |
|
GHSA-j5xf-gv89-g422
Aliases: CVE-2023-5544 |
Moodle Cross-site Scripting vulnerability Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential … |
Vulnerable |
|
GHSA-fm5h-58g2-4m3f
Aliases: CVE-2023-5549 |
Moodle Improper Access Control vulnerability Insufficient web service capability checks made it possible to move categories a user had permission … |
Vulnerable |
|
GHSA-26fg-v32r-h663
Aliases: CVE-2023-5545 |
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability H5P metadata automatically populated the author with the user's username, … |
Vulnerable |
|
GHSA-cwh2-q44x-5w3c
Aliases: CVE-2023-5548 |
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability Stronger revision number limitations were required on file serving endpoints … |
Vulnerable |
|
GHSA-8mm2-m2gp-c6x2
Aliases: CVE-2023-5542 |
Moodle Improper Access Control vulnerability Students in "Only see own membership" groups could see other students in the group, which … |
Vulnerable |
|
GHSA-w8x2-w4qr-v3x4
Aliases: CVE-2023-5540 |
Moodle Code Injection vulnerability A remote code execution risk was identified in the IMSCP activity. By default this was only … |
Vulnerable |
|
GHSA-9724-h8p7-r3jv
Aliases: CVE-2023-5546 |
Moodle Cross-site Scripting vulnerability ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS … |
Vulnerable |
|
GHSA-cg8j-5cr2-568q
Aliases: CVE-2026-26047 |
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits A Denial of Service vulnerability was … |
Not vulnerable |
|
GHSA-ggxq-2mg9-8966
Aliases: CVE-2026-26045 |
Moodle has a Remote Code Execution risk via file restore A flaw was identified in Moodle’s backup restore functionality where … |
Not vulnerable |
|
GHSA-xvmh-25jw-gmmm
Aliases: CVE-2025-67847 |
Moodle affected by a code injection vulnerability A flaw was found in Moodle. An attacker with access to the restore … |
Vulnerable |