Search for packages
| purl | pkg:composer/moodle/moodle@4.4.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-w29j-8phw-ffjf
Aliases: CVE-2025-62401 |
Moodle has a time restriction bypass An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, … |
Vulnerable |
|
GHSA-m58f-9pvv-8mp2
Aliases: CVE-2025-62399 |
Moodle vulnerable to brute-force password guesses Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, … |
Vulnerable |
|
GHSA-422v-w6c5-vq42
Aliases: CVE-2025-62400 |
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view … |
Vulnerable |
|
GHSA-25wf-7x6c-wmpf
Aliases: CVE-2025-62398 |
Moodle does not properly enforce MFA A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under … |
Vulnerable |
|
GHSA-cpm7-mv33-jwf8
Aliases: CVE-2025-3644 |
Moodle's AJAX section delete does not respect course_can_delete_section() A flaw was found in Moodle. Additional checks were required to prevent … |
Vulnerable |
|
GHSA-88xj-97gf-7wpq
Aliases: CVE-2025-3635 |
Moodle has a CSRF risk in user tours manager that allows tour duplication A security vulnerability was discovered in Moodle … |
Vulnerable |
|
GHSA-chmf-m33p-ph8m
Aliases: CVE-2025-3636 |
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds A flaw was found in Moodle. This … |
Vulnerable |
|
GHSA-qhc7-xhc2-7p7w
Aliases: CVE-2025-3634 |
Moodle self enrollment available before completing second factor with MFA enabled A security vulnerability was discovered in Moodle that allows … |
Vulnerable |
|
GHSA-hxgg-4qww-85ph
Aliases: CVE-2025-3643 |
Moodle has reflected Cross-site Scripting risk in policy tool A flaw was found in Moodle. The return URL in the … |
Vulnerable |
|
GHSA-m8qh-hx4c-h9hr
Aliases: CVE-2025-3638 |
Moodle has a CSRF risk in Brickfield tool's analysis request action A flaw was found in Moodle. The analysis request … |
Vulnerable |
|
GHSA-34g7-pg9j-pxgp
Aliases: CVE-2025-3647 |
Moodle allows IDOR when accessing the cohorts report A flaw was discovered in Moodle. Additional checks were required to ensure … |
Vulnerable |
|
GHSA-pj96-xh2w-fgqx
Aliases: CVE-2025-3645 |
Moodle has an IDOR in messaging web service which allows access to some user details A flaw was found in … |
Vulnerable |
|
GHSA-8m7c-hm88-2p97
Aliases: CVE-2025-32045 |
Moodle shows hidden grades to users without permission on some grade reports A flaw has been identified in Moodle where … |
Vulnerable |
|
GHSA-m367-445c-2xqr
Aliases: CVE-2025-3642 |
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository A flaw was found in Moodle. … |
Vulnerable |
|
GHSA-c8v6-vxhf-wcrr
Aliases: CVE-2025-3641 |
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository A flaw was found in Moodle. … |
Vulnerable |
|
GHSA-x45j-jq9q-gf3q
Aliases: CVE-2025-3627 |
Moodle makes some user data available before completing second factor with MFA enabled A security vulnerability was discovered in Moodle … |
Vulnerable |
|
GHSA-6g5x-h5x7-q4mq
Aliases: CVE-2025-3640 |
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other … |
Vulnerable |
|
GHSA-g88w-v4cq-qgcp
Aliases: CVE-2025-26531 |
Moodle has an IDOR in badges allows disabling of arbitrary badges Insufficient capability checks made it possible to disable badges … |
Vulnerable |
|
GHSA-wr88-x8cm-7cgq
Aliases: CVE-2025-26529 |
Moodle has a stored XSS risk in admin live log Description information displayed in the site administration live log required … |
Vulnerable |
|
GHSA-4hmr-39vp-xfrr
Aliases: CVE-2025-26525 |
Moodle has an arbitrary file read risk through pdfTeX Insufficient sanitizing in the TeX notation filter resulted in an arbitrary … |
Vulnerable |
|
GHSA-4w32-c9g7-27qx
Aliases: CVE-2025-26530 |
Moodle allows reflected XSS via question bank filter The question bank filter required additional sanitizing to prevent a reflected XSS … |
Vulnerable |
|
GHSA-h697-w4ph-7pcx
Aliases: CVE-2025-26528 |
Moodle has a stored XSS in ddimageortext question type The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to … |
Vulnerable |
|
GHSA-pxg4-xjp7-w9c5
Aliases: CVE-2025-26526 |
Moodle's feedback response viewing and deletions did not respect Separate Groups mode Separate Groups mode restrictions were not factored into … |
Vulnerable |
|
GHSA-cw24-f6fq-7j9v
Aliases: CVE-2025-26532 |
Moodle allows teachers to evade trusttext config when restoring glossary entries Additional checks were required to ensure trusttext is applied … |
Vulnerable |
|
GHSA-rg56-94j7-hjx9
Aliases: CVE-2025-26533 |
Moodle has a SQL injection risk in course search module list filter An SQL injection risk was identified in the … |
Vulnerable |
|
GHSA-5r85-6h7f-rg3r
Aliases: CVE-2025-26527 |
Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block Tags not expected … |
Vulnerable |
|
GHSA-g8r3-2v89-j6r5
Aliases: CVE-2024-48900 |
Moodle IDOR when accessing list of badge recipients A vulnerability was found in Moodle. Additional checks are required to ensure … |
Vulnerable |
|
GHSA-fhg2-r2h9-h7q8
Aliases: CVE-2024-45690 |
Moodle IDOR when deleting OAuth2 linked accounts A flaw was found in Moodle. Additional checks were required to ensure users … |
Vulnerable |
|
GHSA-r4xr-m393-778m
Aliases: CVE-2024-48899 |
Moodle IDOR when accessing list of course badges A vulnerability was found in Moodle. Additional checks are required to ensure … |
Vulnerable |
|
GHSA-cq5f-wv7p-5gfc
Aliases: CVE-2024-48896 |
Moodle leaks user names A vulnerability was found in Moodle. It is possible for users with the "send message" capability … |
Vulnerable |
|
GHSA-xfv7-h2qg-rjm7
Aliases: CVE-2024-45691 |
Moodle Lesson activity password bypass through PHP loose comparison A flaw was found in Moodle. When restricting access to a … |
Vulnerable |
|
GHSA-x3x9-349x-2485
Aliases: CVE-2024-48897 |
moodle: IDOR in edit/delete RSS feed A vulnerability was found in Moodle. Additional checks are required to ensure users can … |
Vulnerable |
|
GHSA-mg54-p2wj-5ph7
Aliases: CVE-2024-48901 |
moodle: IDOR when fetching report schedules A vulnerability was found in Moodle. Additional checks are required to ensure users can … |
Vulnerable |
|
GHSA-fjq9-452g-jg3q
Aliases: CVE-2024-48898 |
moodle: Some users can delete audiences of other reports A vulnerability was found in Moodle. Users with access to delete … |
Vulnerable |
|
GHSA-j822-x5gg-5r56
Aliases: CVE-2024-45689 |
Moodle allows users to retrieve information they did not have permission to access A flaw was found in Moodle. Dynamic … |
Vulnerable |
|
GHSA-mhf6-pp52-8wqj
Aliases: CVE-2025-67849 |
Moodle Cross-site Scripting (XSS) vulnerability A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization … |
Vulnerable |
|
GHSA-j5jv-w5cw-j9ff
Aliases: CVE-2025-67848 |
Moodle authentication bypass vulnerability A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through … |
Vulnerable |
|
GHSA-cg8j-5cr2-568q
Aliases: CVE-2026-26047 |
Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits A Denial of Service vulnerability was … |
Not vulnerable |
|
GHSA-5cx4-w4fh-fr57
Aliases: CVE-2025-67853 |
Moodle Affected by Improper Restriction of Excessive Authentication Attempts A flaw was found in Moodle. A remote attacker could exploit … |
Vulnerable |
|
GHSA-vwhw-vp9v-q9c9
Aliases: CVE-2025-67855 |
Moodle vulnerable to Cross-site Scripting A flaw was found in Moodle. A remote attacker could exploit a reflected Cross-Site Scripting … |
Vulnerable |
|
GHSA-qv78-6gpp-hm68
Aliases: CVE-2025-67852 |
Moodle Open Redirect vulnerability A flaw was found in Moodle. An Open Redirect vulnerability in the OAuth login flow allows … |
Vulnerable |
|
GHSA-hcm6-q6pc-xfhm
Aliases: CVE-2025-67856 |
Moodle has an authorization logic flaw A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete … |
Vulnerable |
|
GHSA-qfh6-h7j6-fvjv
Aliases: CVE-2025-67851 |
Moodle formula injection vulnerability A flaw was found in Moodle. This formula injection vulnerability occurs when data fields are exported … |
Vulnerable |
|
GHSA-8jrv-wx83-w3xj
Aliases: CVE-2025-67857 |
Moodle Inserts Sensitive Information Into Sent Data A flaw was found in moodle. During anonymous assignment submissions, user identifiers were … |
Vulnerable |
|
GHSA-6mmv-f6c6-v6q8
Aliases: CVE-2025-67850 |
Moodle vulnerable to Cross-site Scripting A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due … |
Vulnerable |
|
GHSA-ggxq-2mg9-8966
Aliases: CVE-2026-26045 |
Moodle has a Remote Code Execution risk via file restore A flaw was identified in Moodle’s backup restore functionality where … |
Not vulnerable |
|
GHSA-xvmh-25jw-gmmm
Aliases: CVE-2025-67847 |
Moodle affected by a code injection vulnerability A flaw was found in Moodle. An attacker with access to the restore … |
Vulnerable |
|
GHSA-9vc3-vm42-fjhm
Aliases: CVE-2025-3637 |
Moodle's mod_data edit/delete pages pass CSRF token in GET parameter A security vulnerability was found in Moodle where confidential information … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-4gq2-x5w4-7hp8
|
Moodle has insufficient capability checks A flaw was found in moodle. Insufficient capability checks make it possible for users with … |
CVE-2024-43435
|
|
GHSA-c767-4whh-v7rw
|
Moodle has user information visibility control issues in gradebook reports A flaw was found in moodle. Some hidden user profile … |
CVE-2024-43429
|
|
GHSA-vpq5-56jj-vf2m
|
Moodle admin presets export tool includes some secrets that should not be exported A flaw was found in moodle. When … |
CVE-2024-43427
|
|
GHSA-v6f4-v8h8-3c87
|
Moodle Remote Code Execution vulnerability A flaw was found in Moodle. Additional restrictions are required to avoid a remote code … |
CVE-2024-43425
|
|
GHSA-q99x-mjmh-v8w7
|
Moodle's user/power level management inconsistent with suspended users A flaw was found in moodle. Matrix room membership and power levels … |
CVE-2024-43433
|
|
GHSA-mx26-62xm-2p83
|
Moodle vulnerable to site administration SQL injection via XMLDB editor A SQL injection risk flaw was found in the XMLDB … |
CVE-2024-43436
|
|
GHSA-jpf2-9ppp-2c49
|
Moodle has insufficient access control A flaw was found in moodle. External API access to Quiz can override contained insufficient … |
CVE-2024-43430
|
|
GHSA-2r9m-wg35-rfvc
|
Moodle vulnerable to cache poisoning via injection into storage To address a cache poisoning risk in Moodle, additional validation for … |
CVE-2024-43428
|
|
GHSA-4hjf-6pxr-549h
|
Moodle Cross-site Scripting vulnerability A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result … |
CVE-2024-43437
|
|
GHSA-p9cx-f595-h79h
|
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users A flaw was found in Feedback. Bulk messaging in … |
CVE-2024-43438
|
|
GHSA-7wmp-2xmx-g6h8
|
Moodle authorization headers preserved between "emulated redirects" A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH … |
CVE-2024-43432
|
|
GHSA-x87r-37q5-mmr8
|
Moodle has CSRF risk in Feedback non-respondents report The bulk message sending feature in Moodle's Feedback module's non-respondents report had … |
CVE-2024-43434
|
|
GHSA-vjmm-r9gg-425m
|
Moodle has arbitrary file read risk through pdfTeX A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation … |
CVE-2024-43426
|
|
GHSA-qrqv-26gf-xgwh
|
Moodle LFI vulnerability when restoring malformed block backups A flaw was found in moodle. A local file may include risks … |
CVE-2024-43440
|
|
GHSA-wwjf-gwrv-wh45
|
Moodle's IDOR in badges allows deletion of arbitrary badges A vulnerability was found in Moodle. Insufficient capability checks made it … |
CVE-2024-43431
|
|
GHSA-hjgc-jxjc-8v9j
|
Moodle reflected XSS via H5P error message A flaw was found in moodle. H5P error messages require additional sanitizing to … |
CVE-2024-43439
|