moodle
214 published vulnerabilities name this product. The 200 most recent are listed.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-102588 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: csrf in xml grade import | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-102587 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: user list filters bypass profile field visibility | LOW 2.7 | 0.2 % | ||
| CVE-2026-102586 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: xss via password reset link due to insufficient username escaping | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-102585 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 | Moodle: group validation missing when enrolling user to course | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-102584 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 | Moodle: missing capability check allows unauthorised grade penalty recalculation | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-102583 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: incorrect capability check in ai generate image web service | LOW 2.7 | 0.2 % | ||
| CVE-2026-102582 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: manual enrolment page accessible when plugin disabled | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-102581 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: xss in forum post templates due to insufficient escaping | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-102580 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: arbitrary class instantiation via report builder audience classname | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-102579 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: user profile information disclosure via grade web service | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-102578 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: sql injection in question bank web service | HIGH 8.8 | 0.3 % | ||
| CVE-2026-102577 | 5.2.0 – < 5.2.2 ; 5.1.0 – < 5.1.6 ; 5.0.0 – < 5.0.9 ; … | Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-26047 | < 4.5.9 ; 5.0.0 – < 5.0.5 ; 5.1.0 – < 5.1.2 | Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-26046 | < 4.5.9 ; 5.0.0 – < 5.0.5 ; 5.1.0 – < 5.1.2 | Moodle: moodle: improper input sanitization in tex filter administration setting | HIGH 7.2 | 14 % | ||
| CVE-2026-26045 | < 4.5.9 ; 5.0.0 – < 5.0.5 ; 5.1.0 – < 5.1.2 | Moodle: moodle: improper validation in file restore functionality leading to remote code execution | HIGH 7.2 | 0.6 % | ||
| CVE-2025-67857 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: data exposure of user identifiers in urls | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-67856 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: privilege escalation via incomplete role checks in badge awarding | CRITICAL 9.8 | 0.3 % | ||
| CVE-2025-67855 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting | MEDIUM 6.1 | 0.4 % | ||
| CVE-2025-67853 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service | HIGH 7.5 | 0.5 % | ||
| CVE-2025-67852 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites. | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-67851 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export | HIGH 7.8 | 0.3 % | ||
| CVE-2025-67850 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor | HIGH 7.3 | 0.3 % | ||
| CVE-2025-67849 | 4.5.0 – < 4.5.8 ; 5.0.0 – < 5.0.4 ; 5.1.0 – < 5.1.1 | Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses | HIGH 7.3 | 0.3 % | ||
| CVE-2025-67848 | 4.1.0 – < 4.1.22 ; 4.4.0 – < 4.4.12 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access. | HIGH 8.1 | 0.4 % | ||
| CVE-2025-67847 | 5.1.0 – < 5.1.1 ; 5.0.0 – < 5.0.4 ; 4.5.0 – < 4.5.8 ; … | Moodle: moodle: remote code execution via insufficient restore input validation | HIGH 8.8 | 0.6 % | ||
| CVE-2025-62401 | 5.0.0 – < 5.0.3 ; 4.5.0 – < 4.5.7 ; 4.4.0 – < 4.4.11 ; … | Moodle: possible to bypass timer in timed assignments | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-62395 | 5.0.0 – < 5.0.3 ; 4.5.0 – < 4.5.7 ; 4.4.0 – < 4.4.11 ; … | Moodle: external cohort search service leaks system cohort data | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-62400 | 5.0.0 – < 5.0.3 ; 4.5.0 – < 4.5.7 ; 4.4.0 – < 4.4.11 ; … | Moodle: hidden group names visible to event creators | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-62399 | 5.0.0 – < 5.0.3 ; 4.5.0 – < 4.5.7 ; 4.4.0 – < 4.4.11 ; … | Moodle: password brute force risk when mobile/web services enabled | HIGH 7.5 | 0.4 % | ||
| CVE-2025-62398 | 5.0.0 – < 5.0.3 ; 4.5.0 – < 4.5.7 ; 4.4.0 – < 4.4.11 | Moodle: possible to bypass mfa | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-62397 | 5.0.0 – < 5.0.3 | Moodle: router produces json instead of 404 error for invalid course id | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-62396 | 5.0.0 – < 5.0.3 ; 4.5.0 – < 4.5.7 | Moodle: router (r.php) could expose application directories | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-62394 | 5.0.0 – < 5.0.3 ; 4.5.0 – < 4.5.7 | Moodle: quiz notifications sent to suspended participants | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-62393 | 5.0.0 – < 5.0.3 | Moodle: course access permissions not properly checked in course_output_fragment_course_overview | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-32045 | 4.5.3 ; 4.4.7 ; 4.3.11 ; … | Moodle: hidden grades shown to users without permission on some grade reports | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-32044 | 4.5.0 – 4.5.2 | Moodle: unauthenticated rest api user data exposure | HIGH 7.5 | 0.5 % | ||
| CVE-2025-3647 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: idor when accessing the cohorts report | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-3645 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: idor in messaging web service allows access to some user details | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-3644 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: ajax section delete does not respect course_can_delete_section() | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-3643 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: reflected xss risk in policy tool | MEDIUM 5.4 | 0.3 % | ||
| CVE-2025-3642 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: authenticated remote code execution risk in the moodle lms equella repository | HIGH 8.8 | 1.1 % | ||
| CVE-2025-3641 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: authenticated remote code execution risk in the moodle lms dropbox repository | HIGH 8.8 | 1.0 % | ||
| CVE-2025-3640 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: idor in web service allows users enrolled in a course to access some details of other users | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-3638 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: csrf risk in brickfield tool's analysis request action | HIGH 8.8 | 0.3 % | ||
| CVE-2025-3637 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: csrf token exposure via url in moodle mod_data module | LOW 3.1 | 0.4 % | ||
| CVE-2025-3636 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: idor in moodle rss block allows unauthorized access to rss feeds | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-3635 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 ; … | Moodle: csrf risk in moodle user tours manager allows tour duplication | LOW 3.5 | 0.2 % | ||
| CVE-2025-3628 | 4.5.0 – < 4.5.4 | Moodle: moodle assignment submission search leaks anonymous student identities | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-3627 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 | Moodle: partial data exposure in moodle before completing multi-factor authentication | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-3625 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 | Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action | HIGH 7.1 | 0.4 % | ||
| CVE-2025-3634 | 4.5.0 – < 4.5.4 ; 4.4.0 – < 4.4.8 ; 4.3.0 – < 4.3.12 | Moodle: moodle allows course self-enrolment before completing mfa | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-48899 | 4.4.0 – < 4.4.4 | Moodle: idor when accessing list of course badges | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-45691 | < 4.1.13 ; 4.2 – < 4.2.10 ; 4.3 – < 4.3.7 ; … | Moodle: lesson activity password bypass through php loose comparison | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-45690 | < 4.1.13 ; 4.2 – < 4.2.10 ; 4.3 – < 4.3.7 ; … | Moodle: idor when deleting oauth2 linked accounts | HIGH 7.5 | 0.4 % | ||
| CVE-2024-45689 | < 4.1.13 ; 4.2 – < 4.2.10 ; 4.3 – < 4.3.7 ; … | Moodle: unprotected access to sensitive information via dynamic tables | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-48901 | 4.4.0 – < 4.4.4 ; 4.3.0 – < 4.3.8 ; 4.2.0 – < 4.2.11 ; … | Moodle: idor when fetching report schedules | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-48898 | 4.4.0 – < 4.4.4 ; 4.3.0 – < 4.3.8 ; 4.2.0 – < 4.2.11 ; … | Moodle: some users can delete audiences of other reports | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-48897 | 4.4.0 – < 4.4.4 ; 4.3.0 – < 4.3.8 ; 4.2.0 – < 4.2.11 ; … | Moodle: idor in edit/delete rss feed | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-48896 | 4.4.0 – < 4.4.4 ; 4.3.0 – < 4.3.8 ; 4.2.0 – < 4.2.11 ; … | Moodle: users' names returned in messaging error message | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-48900 | 4.4.0 – < 4.4.4 | Moodle: idor when accessing list of badge recipients | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-43439 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: reflected xss via h5p error message | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-43437 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: xss risk when restoring malicious course backup file | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-43435 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: can create global glossary without being admin | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-43433 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: matrix user/power level management not always working as expected with suspended users | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-43432 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: authorization headers preserved between "emulated redirects" | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-43430 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: lack of access control when using external methods for quiz overrides | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-43429 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: user information visibility control issues in gradebook reports | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-43427 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: admin presets export tool includes some secrets that should not be exported | LOW 3.7 | 0.3 % | ||
| CVE-2024-43440 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: lfi vulnerability when restoring malformed block backups | HIGH 7.5 | 0.6 % | ||
| CVE-2024-43438 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: idor in feedback non-respondents report allows messaging arbitrary site users | HIGH 7.5 | 0.5 % | ||
| CVE-2024-43436 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: site administration sql injection via xmldb editor | HIGH 7.2 | 0.8 % | ||
| CVE-2024-43434 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: csrf risk in feedback non-respondents report | HIGH 8.1 | 0.6 % | ||
| CVE-2024-43431 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: idor in badges allows deletion of arbitrary badges | HIGH 7.5 | 0.5 % | ||
| CVE-2024-43428 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: cache poisoning via injection into storage | HIGH 7.7 | 0.2 % | ||
| CVE-2024-43426 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: arbitrary file read risk through pdftex | HIGH 7.5 | 0.7 % | ||
| CVE-2024-43425 | < 4.1.12 ; 4.2 – < 4.2.9 ; 4.3 – < 4.3.6 ; … | Moodle: remote code execution via calculated question types | HIGH 8.1 | 88 % | ||
| CVE-2024-34009 | 4.3 – 4.3.3 | moodle: ReCAPTCHA can be bypassed on the login page | HIGH 7.5 | 0.4 % | ||
| CVE-2024-34008 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: CSRF risk in analytics management of models | HIGH 8.8 | 0.4 % | ||
| CVE-2024-34007 | 4.3 – 4.3.3 | moodle: logout CSRF in admin/tool/mfa/auth.php | HIGH 8.8 | 0.4 % | ||
| CVE-2024-34006 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: unsanitized HTML in site log for config_log_created | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-34005 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-34004 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-34003 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup | MEDIUM 5.9 | 0.4 % | ||
| CVE-2024-34002 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-34001 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: CSRF risk in admin preset tool management of presets | HIGH 8.4 | 0.4 % | ||
| CVE-2024-34000 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: stored XSS in lesson overview report via user ID number | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-33999 | 4.3 – 4.3.3 | moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php | CRITICAL 9.8 | 0.5 % | ||
| CVE-2024-33998 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: stored XSS via user's name on participants page when opening some options | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-33997 | 4.0 – 4.3.3 ; 4.2 – 4.2.6 ; 4.1 – 4.1.9 | moodle: stored XSS risk when editing another user's equation in equation editor | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-25983 | 4.3.0 – < 4.3.3 ; 4.2.0 – < 4.2.6 ; < 4.1.9 | Msa-24-0006: idor on dashboard comments block | MEDIUM 5.3 | 0.6 % | ||
| CVE-2024-25982 | 4.3.0 – < 4.3.3 ; 4.2.0 – < 4.2.6 ; < 4.1.9 | Msa-24-0005: csrf risk in language import utility | HIGH 8.8 | 0.5 % | ||
| CVE-2024-25981 | 4.3.0 – < 4.3.3 ; 4.2.0 – < 4.2.6 ; < 4.1.9 | Msa-24-0004: forum export did not respect activity group settings | MEDIUM 5.3 | 0.6 % | ||
| CVE-2024-25980 | 4.3.0 – < 4.3.3 ; 4.2.0 – < 4.2.6 ; < 4.1.9 | Msa-24-0003: h5p attempts report did not respect activity group settings | MEDIUM 5.3 | 0.5 % | ||
| CVE-2024-25979 | 4.3.0 – < 4.3.3 ; 4.2.0 – < 4.2.6 ; < 4.1.9 | Msa-24-0002: forum search accepted random parameters in its url | MEDIUM 5.3 | 0.6 % | ||
| CVE-2024-25978 | 4.3.0 – < 4.3.3 ; 4.2.0 – < 4.2.6 ; < 4.1.9 | Msa-24-0001: denial of service risk in file picker unzip functionality | HIGH 7.5 | 0.9 % | ||
| CVE-2023-5543 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 | Moodle: duplicating a bigbluebutton activity assigns the same meeting id | LOW 3.3 | 0.3 % | ||
| CVE-2023-5551 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: forum summary report shows students from other groups when in separate groups mode | LOW 3.3 | 0.3 % | ||
| CVE-2023-5550 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: rce due to lfi risk in some misconfigured shared hosting environments | CRITICAL 9.8 | 1.6 % | ||
| CVE-2023-5549 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: insufficient capability checks when updating the parent of a course category | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-5548 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: cache poisoning risk with endpoint revision numbers | MEDIUM 5.3 | 0.3 % | ||
| CVE-2023-5547 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: xss risk when previewing data in course upload tool | MEDIUM 6.1 | 0.5 % | ||
| CVE-2023-5546 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 | Moodle: stored xss in quiz grading report via user id number | MEDIUM 5.4 | 1.3 % | ||
| CVE-2023-5545 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: auto-populated h5p author name causes a potential information leak | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-5544 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: stored xss and potential idor risk in wiki comments | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-5542 | 4.2.2 | Moodle: students can view other users in "only see own membership" groups | MEDIUM 4.3 | 0.5 % | ||
| CVE-2023-5541 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: xss risk when using csv grade import method | MEDIUM 6.1 | 0.5 % | ||
| CVE-2023-5540 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: authenticated remote code execution risk in imscp | HIGH 8.8 | 2.3 % | ||
| CVE-2023-5539 | 4.2.0 – < 4.2.3 ; 4.1.0 – < 4.1.6 ; 4.0.0 – < 4.0.11 ; … | Moodle: authenticated remote code execution risk in lesson | HIGH 8.8 | 2.2 % | ||
| CVE-2023-35133 | 4.2.0 – < 4.2.1 ; 4.1.0 – < 4.1.4 ; 4.0.0 – < 4.0.9 ; … | Moodle: ssrf risk due to insufficient check on the curl blocked hosts | HIGH 7.5 | 0.8 % | ||
| CVE-2023-35132 | 4.2.0 – < 4.2.1 ; 4.1.0 – < 4.1.4 ; 4.0.0 – < 4.0.9 ; … | Moodle: minor sql injection risk on mnet sso access control page | MEDIUM 6.3 | 0.8 % | ||
| CVE-2023-35131 | 4.2.0 – < 4.2.1 ; 4.1.0 – < 4.1.4 ; 4.0.0 – < 4.0.9 ; … | Moodle: xss risk on groups page | MEDIUM 6.1 | 0.7 % | ||
| CVE-2023-30944 | 4.1.0 – < 4.1.3 ; 4.0.0 – < 4.0.8 ; 3.11.0 – < 3.11.14 ; … | Moodle: minor sql injection risk in external wiki method for listing pages | HIGH 7.3 | 1.1 % | ||
| CVE-2023-30943 | 4.1.0 – < 4.1.3 | Moodle: tinymce loaders susceptible to arbitrary folder creation | MEDIUM 6.5 | 6.8 % | ||
| CVE-2022-40208 | affected 4.0 to 4.0.2, 3.11 to 3.11.8, 3.9 to 3.9.15 and earlier unsupported versions | In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz at | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-28336 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 ; 3.11.0 – < 3.11.13 ; … | Moodle: teacher can access names of users they do not have permission to access | MEDIUM 4.3 | 0.7 % | ||
| CVE-2023-28335 | 4.1.0 – < 4.1.2 | Moodle: csrf risk in resetting all templates of a database activity | HIGH 8.8 | 0.4 % | ||
| CVE-2023-28334 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 | Moodle: users' name enumeration possible via idor on learning plans page | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-28333 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 ; 3.11.0 – < 3.11.13 ; … | Moodle: pix helper potential mustache code injection risk | CRITICAL 9.8 | 1.2 % | ||
| CVE-2023-28332 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 ; 3.11.0 – < 3.11.13 ; … | Moodle: algebra filter xss when filter is misconfigured | MEDIUM 6.1 | 0.6 % | ||
| CVE-2023-28331 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 ; 3.11.0 – < 3.11.13 ; … | Moodle: xss risk when outputting database activity filter data | MEDIUM 6.1 | 0.7 % | ||
| CVE-2023-28330 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 ; 3.11.0 – < 3.11.13 ; … | Moodle: authenticated arbitrary file read through malformed backup file | MEDIUM 6.5 | 1.2 % | ||
| CVE-2023-28329 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 ; 3.11.0 – < 3.11.13 ; … | Moodle: authenticated sql injection via availability check | HIGH 8.8 | 1.2 % | ||
| CVE-2023-1402 | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.7 ; 3.11.0 – < 3.11.13 ; … | Moodle: course participation report shows roles the user should not see | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-36403 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may | MEDIUM 5.3 | 0.5 % | ||
| CVE-2021-36402 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. | MEDIUM 5.3 | 0.5 % | ||
| CVE-2021-36401 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. | MEDIUM 4.8 | 0.5 % | ||
| CVE-2021-36400 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. | MEDIUM 5.3 | 0.5 % | ||
| CVE-2021-36399 | 3.11 | In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-36398 | 3.11 | In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-36397 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, insufficient capability checks meant message deletions were not limited to the current user. | MEDIUM 5.3 | 0.6 % | ||
| CVE-2021-36396 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a b | HIGH 7.5 | 1.4 % | ||
| CVE-2021-36395 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. | HIGH 7.5 | 0.7 % | ||
| CVE-2021-36394 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. | CRITICAL 9.8 | 7.0 % | ||
| CVE-2021-36393 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. | CRITICAL 9.8 | 52 % | ||
| CVE-2021-36392 | 3.11, 3.10 to 3.10.4, 3.9 to 3.9.7 and earlier unsupported versions | In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. | CRITICAL 9.8 | 0.8 % | ||
| CVE-2023-23923 | 4.1.0 – < 4.1.1 ; 4.0.0 – < 4.0.6 ; 3.11.0 – < 3.11.12 ; … | Moodle: possible to set the preferred "start page" of other users | HIGH 8.2 | 1.0 % | ||
| CVE-2023-23922 | 4.1.0 – < 4.1.1 ; 4.0.0 – < 4.0.6 | Moodle: reflected xss risk in blog search | MEDIUM 6.1 | 0.9 % | ||
| CVE-2023-23921 | 4.1.0 – < 4.1.1 ; 4.0.0 – < 4.0.6 ; 3.11.0 – < 3.11.12 ; … | Moodle: reflected xss risk in some returnurl parameters | MEDIUM 6.1 | 0.8 % | ||
| CVE-2022-45152 | Fixed in moodle 4.0.5, moodle 3.11.11, moodle 3.9.18 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-suppli | CRITICAL 9.1 | 1.4 % | ||
| CVE-2022-45151 | Fixed in moodle 4.0.5, moodle 3.11.11 | The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social | MEDIUM 5.4 | 0.7 % | ||
| CVE-2022-45150 | Fixed in moodle 4.0.5, moodle 3.11.11, moodle 3.9.18 | A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied | MEDIUM 6.1 | 0.7 % | ||
| CVE-2022-45149 | Fixed in moodle 4.0.5, moodle 3.11.11, moodle 3.9.18 | A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's | MEDIUM 5.4 | 0.4 % | ||
| CVE-2022-2986 | moodle 4.0.3 and moodle 3.11.9 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. | HIGH 8.8 | 0.5 % | ||
| CVE-2022-40316 | 4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions | The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers ab | MEDIUM 4.3 | 0.7 % | ||
| CVE-2022-40315 | 4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions | A limited SQL injection risk was identified in the "browse list of users" site administration page. | CRITICAL 9.8 | 1.1 % | ||
| CVE-2022-40313 | 4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions | Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load | HIGH 7.1 | 0.7 % | ||
| CVE-2022-40314 | 4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. | CRITICAL 9.8 | 2.1 % | ||
| CVE-2020-14320 | Moodle 3.9, 3.8 to 3.8.3 and 3.7 to 3.7.6 | In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk. | MEDIUM 6.1 | 0.7 % | ||
| CVE-2020-1756 | 3.8 to 3.8.1, 3.7 to 3.7.4, 3.6 to 3.6.8, 3.5 to 3.5.10 and earlier unsupported versions | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool. | HIGH 7.2 | 1.0 % | ||
| CVE-2020-1755 | 3.8 to 3.8.1, 3.7 to 3.7.4, 3.6 to 3.6.8, 3.5 to 3.5.10 and earlier unsupported versions | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote addre | MEDIUM 5.3 | 0.5 % | ||
| CVE-2020-14322 | Moodle 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of deni | HIGH 7.5 | 0.9 % | ||
| CVE-2020-14321 | Moodle 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. | HIGH 8.8 | 16 % | ||
| CVE-2020-1754 | 3.8.2, 3.7.5, 3.6.9 and 3.5.11 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not | MEDIUM 4.3 | 0.7 % | ||
| CVE-2020-1691 | 3.8 | In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site script | MEDIUM 5.4 | 0.6 % | ||
| CVE-2022-35653 | Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15 | A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied | MEDIUM 6.1 | 4.8 % | ||
| CVE-2022-35652 | Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15 | An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacke | MEDIUM 6.1 | 1.1 % | ||
| CVE-2022-35651 | Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15 | A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM tr | MEDIUM 6.1 | 1.1 % | ||
| CVE-2022-35650 | Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15 | The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks r | HIGH 7.5 | 54 % | ||
| CVE-2022-35649 | Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter | CRITICAL 9.8 | 8.6 % | ||
| CVE-2022-30600 | Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. | CRITICAL 9.8 | 5.1 % | ||
| CVE-2022-30599 | Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. | CRITICAL 9.8 | 1.4 % | ||
| CVE-2022-30598 | Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions | A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise ha | MEDIUM 4.3 | 1.1 % | ||
| CVE-2022-30597 | Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions | A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. | MEDIUM 5.3 | 1.3 % | ||
| CVE-2022-30596 | Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions | A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent | MEDIUM 5.4 | 0.9 % | ||
| CVE-2022-0984 | moodle 3.11.6, moodle 3.10.10, moodle 3.9.13 | Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile f | MEDIUM 4.3 | 0.6 % | ||
| CVE-2022-0985 | moodle 3.11.6, moodle 3.10.10, moodle 3.9.13 | Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary m | MEDIUM 4.3 | 0.6 % | ||
| CVE-2022-0983 | moodle 3.11.6, moodle 3.10.10, moodle 3.9.13 | An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teach | HIGH 8.8 | 0.9 % | ||
| CVE-2021-32474 | 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 | An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this re | HIGH 7.2 | 0.9 % | ||
| CVE-2021-32473 | 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to | MEDIUM 5.3 | 1.0 % | ||
| CVE-2021-32475 | 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3 | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-32477 | 3.10 to 3.10.3 | The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capabil | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-32478 | 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 | The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versio | MEDIUM 6.1 | 1.1 % | ||
| CVE-2021-32476 | 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 | A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3 | HIGH 7.5 | 1.1 % | ||
| CVE-2021-32472 | 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 | Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10. | MEDIUM 4.3 | 0.8 % | ||
| CVE-2022-0335 | moodle 3.11.5, moodle 3.10.9 and moodle 3.9.12 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge ali | HIGH 8.8 | 0.6 % | ||
| CVE-2022-0334 | moodle 3.11.5, moodle 3.10.9 and moodle 3.9.12 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capabili | MEDIUM 4.3 | 0.7 % | ||
| CVE-2022-0333 | moodle 3.11.5, moodle 3.10.9 and moodle 3.9.12 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageen | LOW 3.8 | 0.6 % | ||
| CVE-2022-0332 | moodle 3.11.5 | A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for | CRITICAL 9.8 | 44 % | ||
| CVE-2021-40691 | 3.11 to 3.11.2, 3.10 to 3.10.6, 3.9 to 3.9.9 and earlier unsupported versions | A session hijack risk was identified in the Shibboleth authentication plugin. | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-40695 | 3.11 to 3.11.2, 3.10 to 3.10.6, 3.9 to 3.9.9 and earlier unsupported versions | It was possible for a student to view their quiz grade before it had been released, using a quiz web service. | MEDIUM 4.3 | 0.9 % | ||
| CVE-2021-40693 | 3.11 to 3.11.2, 3.10 to 3.10.6, 3.9 to 3.9.9 and earlier unsupported versions | An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. | MEDIUM 6.5 | 0.8 % | ||
| CVE-2021-40692 | 3.11 to 3.11.2, 3.10 to 3.10.6, 3.9 to 3.9.9 and earlier unsupported versions | Insufficient capability checks made it possible for teachers to download users outside of their courses. | MEDIUM 4.3 | 0.6 % | ||
| CVE-2021-40694 | 3.11 to 3.11.2, 3.10 to 3.10.6, 3.9 to 3.9.9 and earlier unsupported versions | Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system accou | MEDIUM 4.9 | 0.9 % | ||
| CVE-2021-43560 | moodle 3.11.4, moodle 3.10.8 and moodle 3.9.11 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capabili | MEDIUM 5.3 | 1.1 % | ||
| CVE-2021-43559 | moodle 3.11.4, moodle 3.10.8 and moodle 3.9.11 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related b | HIGH 8.8 | 0.6 % | ||
| CVE-2021-43558 | moodle 3.11.4, moodle 3.10.8 and moodle 3.9.11 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in th | MEDIUM 6.1 | 0.9 % | ||
| CVE-2021-3943 | moodle 3.11.4, moodle 3.10.8 and moodle 3.9.11 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code executi | CRITICAL 9.8 | 2.4 % | ||
| CVE-2021-21809 | Moodle 3.10 | A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP reques | CRITICAL 9.1 | 24 % | ||
| CVE-2019-14827 | 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions | A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts | MEDIUM 6.1 | 0.7 % | ||
| CVE-2019-14831 | 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link co | MEDIUM 6.1 | 0.8 % | ||
| CVE-2019-14830 | 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpo | MEDIUM 6.1 | 3.3 % | ||
| CVE-2019-14829 | 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions | A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creat | MEDIUM 4.3 | 0.8 % | ||
| CVE-2019-14828 | 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions | A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with th | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-20283 | Fixed in 3.10.2, 3.9.5, 3.8.8, 3.5.17 | The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that | MEDIUM 4.3 | 1.1 % | ||
| CVE-2021-20282 | Fixed in 3.10.2, 3.9.5, 3.8.8, 3.5.17 | When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle be | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-20281 | Fixed in 3.10.2, 3.9.5, 3.8.8, 3.5.17 | It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10. | MEDIUM 5.3 | 1.4 % | ||
| CVE-2021-20280 | Fixed in 3.10.2, 3.9.5, 3.8.8, 3.5.17 | Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, | MEDIUM 5.4 | 1.3 % | ||
| CVE-2021-20279 | Fixed in 3.10.2, 3.9.5, 3.8.8, 3.5.17 | The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. | MEDIUM 5.4 | 1.0 % | ||
| CVE-2021-20185 | moodle 3.10.1, moodle 3.9.4, moodle 3.8.7, moodle 3.5.16 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, | MEDIUM 5.3 | 1.4 % | ||
| CVE-2021-20184 | moodle 3.10.1, moodle 3.9.4, moodle 3.8.7 | It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant | MEDIUM 4.3 | 0.7 % |