Moodle
Monthly
Path traversal in Moodle's Blackboard question-import format lets an authenticated Teacher-level user copy arbitrary files readable by the web server - notably config.php, which holds database credentials and the site salt - into their own draft file area. Affected releases are 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11 and 4.5.x through 4.5.15; scoring is CVSS 4.0 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), a confidentiality-only impact gated behind existing question-import or lesson-edit rights. There is no CISA KEV listing and no confirmed working exploit code; a public Abraxas Labs research writeup describes the flaw, and the issue is prioritized for remediation this week.
Authenticated users on Moodle instances running the Configurable Reports block before 5.3.0 can read restricted SQL reports containing user and grade data by supplying arbitrary report IDs to the block_configurable_reports_get_report_data web service. The CWE-863 authorization bypass occurs because a failed check_permissions call adds only a warning and still returns the full report table, so any valid logged-in account can access reports without the required permissions when Moodle web services are enabled. Exploitation requires a valid login but no elevated role, impact is read-only confidentiality loss, and no public exploit identified at time of analysis.
Authenticated SQL injection in Moodle's question bank web service allows a low-privilege user to inject unsanitized input into database queries, potentially exposing, modifying, or deleting sensitive data in the underlying database. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid account that can reach the question bank web-service endpoint is a potential vector - exploitation by fully anonymous users is not possible, and the requirement for credentials and for the web service to be enabled/exposed are the main limiting factors. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (14th percentile), and CISA SSVC rates exploitation as none with partial technical impact; this is a credible, exploitable issue but not an emergency.
Moodle's TeX filter fails to properly sanitize administrative configuration inputs, enabling command injection on systems with ImageMagick installed. An authenticated administrator can inject arbitrary system commands through a malicious TeX filter setting, achieving code execution with the privileges of the Moodle server process. No patch is currently available, and exploitation requires administrative access but could compromise the entire Moodle installation.
Moodle's backup restore function fails to properly validate malicious backup files, allowing authenticated administrators to achieve remote code execution through crafted file processing. An attacker with restore privileges can exploit this code injection vulnerability to fully compromise the Moodle server. No patch is currently available.
A flaw was found in Moodle. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.5%.
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Enrolled students on Moodle can call the core_grades_get_gradeitems web service and receive the IDs, names, and categories of grade items that the gradebook hides from them, because the external function performs no capability check before returning the data. Confirmed affected ranges are 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0, and exploitation requires only a valid account with enrolment in a course that actually contains hidden grade items. Disclosure is limited to hidden item metadata - grade values are not exposed - and there is no CISA KEV listing and no confirmed public exploit code at time of analysis, only a third-party research write-up and the upstream source location; the issue is scored 5.3 and assessed as a moderate-severity information-disclosure problem rather than an emergency.
Non-editing teachers on affected Moodle sites can read grade feedback and identity data (names, email addresses) belonging to groups they are not enrolled in, because the core_grades_get_feedback external web service omits group-membership and enrolment checks and accepts an attacker-supplied userid. Affected branches are Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4 and 5.3.0; the only prerequisite is an authenticated account with at least the non-editing teacher role (CVSS 4.0 vector PR:L) plus reachability of the web service, after which exploitation is a matter of iterating the userid parameter. Confidentiality impact is limited (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no write, code-execution or availability effect; a public research writeup by Abraxas Labs describes the issue, but that reference is not verified as working exploit code and there is no KEV or confirmed in-the-wild exploitation.
SQL injection in Moodle's External database enrolment plugin (enrol_database) lets a user with an editing-teacher role store a backslash-quote payload in a course's idnumber field that is later executed by the scheduled enrolment sync task, allowing them to read data from and manipulate enrolment results in the linked MySQL/MariaDB external database. Only sites that have enabled and configured this non-default enrolment plugin against a MySQL or MariaDB backend are exposed; the payload fires only when the scheduled sync runs, so the attacker does not control trigger timing. No KEV listing is present and no verified working exploit code was identified at time of analysis, though a third-party research writeup is referenced; the source-level links in the advisory point to the affected code in v5.3.0 rather than to a confirmed fix.
SQL injection in the Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 allows an authenticated low-privileged user to read arbitrary database tables - including Moodle user password hashes - through the filter_var request parameter of viewreport.php. Exploitation requires that the attacker hold the capability to view a SQL-type report that was authored with the %%FILTER_VAR%% placeholder, which is why the vector carries AT:P and PR:L; impact is limited to confidentiality (C:H with I:N/A:N) and no user interaction is needed. A vendor patch is available in release 5.3.1, and no public exploit code was identified at time of analysis.
Cross-site request forgery in Moodle's XML grade import lets a remote, unauthenticated attacker set or overwrite student grades by luring a user with grade-management permissions (teacher, manager, or administrator) into visiting an attacker-controlled page while their Moodle session is active. The flaw, tracked upstream as MDL-84545 and rated CVSS 6.5, depends on user interaction and affects grade integrity only, with no confidentiality or availability impact, and no public exploit code has been identified at time of analysis. Exploitation is constrained further by the fact that the forged request only succeeds if the victim's browser still transmits Moodle session cookies cross-site, an increasingly limited condition under modern SameSite cookie defaults.
Moodle user-list filters do not enforce the same profile-field visibility restrictions that are applied when a profile is viewed directly, so an authenticated user holding manager privileges can filter user listings on hidden profile attributes and infer their values from the results returned. The issue is low severity, assessed at CVSS 3.1 base score 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), and is limited to information disclosure - there is no integrity or availability impact and no code execution path. The elevated manager role is the gating prerequisite, so the flaw is not reachable by anonymous visitors or ordinary authenticated users, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting (XSS) in Moodle's password reset page allows unauthenticated remote attackers to execute arbitrary script in a victim's browser by tricking them into opening a crafted password-reset link containing a malicious username. The flaw stems from insufficient sanitization of the username input and is assigned CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). No public exploit code or active exploitation is known at the time of analysis; an upstream fix commit (MDL-88335) is referenced but a released patched version is not independently confirmed.
An authenticated teacher in Moodle can add users to groups that belong to courses they are not authorized to manage, because the enrol-user-into-course-with-group-assignment workflow fails to verify that the supplied group actually belongs to the target course. The flaw is a low-severity authorization weakness (CVSS 4.3, CWE-842, Placement into Incorrect Group) that requires a valid teacher-level account (PR:L) and causes only limited integrity impact to group membership; no public exploit code was identified and there is no evidence of active exploitation at time of analysis. Confidentiality and availability are unaffected, so the practical risk is unauthorized group placement and possible exposure of course-group context rather than data theft or service disruption.
Missing capability check in Moodle's grade-penalty recalculation routine allows any authenticated low-privileged user to trigger unauthorized recalculation and modify grade penalty records, potentially altering student assessment scores. The flaw requires a valid Moodle account but no additional user interaction; it is not known to be actively exploited, and no public exploit code has been identified at time of analysis. Impact is limited to integrity of grade-penalty data with no confidentiality or availability impact.
Authenticated users on Moodle instances with the AI image-generation web service enabled can bypass capability checks to invoke the feature without proper authorization, leading to unauthorized use of AI image generation. This low-severity authorization flaw (CWE-425) requires a valid Moodle account but not the specific capability normally required, and the AI subsystem must be configured; it enables quota/cost abuse but no data disclosure or code execution. No public exploit code or active exploitation is known at time of analysis, and the assessed CVSS is 2.7 with PR:L.
Direct URL access to Moodle's manual enrolment management page allows authenticated users who already hold enrolment-management permissions to modify manual enrolments even after an administrator has disabled the manual enrolment plugin in the UI. The issue is a forced-browsing access-control weakness rated low real risk with integrity-only impact: it does not let unauthenticated or ordinary users exploit it, read data, or escalate privileges. No public exploit identified at time of analysis, and no CISA KEV entry was reported.
Stored cross-site scripting in Moodle's forum post rendering templates allows an authenticated user with forum posting rights - typically any enrolled student or participant - to embed malicious markup in a forum post that executes in the browser of another user who views that post. Exploitation requires a valid low-privileged account (CVSS PR:L) plus victim interaction (UI:R), so it is not self-contained and depends on a second user opening the affected discussion; impact is confined to the victim's browser session, with partial confidentiality and integrity loss and no availability impact (moderate severity, CVSS 3.1 base 4.6). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but upstream fix commits referencing MDL-88981 are already public, which lowers the effort needed to reproduce the issue.
Authenticated Moodle users who hold Report Builder audience-management permissions can abuse an improperly validated audience class name to instantiate arbitrary internal PHP classes, producing unexpected internal objects and altered application behavior (CWE-470, unsafe reflection). The vendor and independent assessment both rate real-world risk as low: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N (score 2.2), because reaching the flaw requires a semi-privileged authenticated account able to create or manage Report Builder audiences, and the attack is rated high complexity with no victim interaction. Impact is bounded to integrity - no confidentiality or availability effect is described - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Moodle's grade web service allows an authenticated student to view profile details of other students enrolled in the same course even though they lack the required capability. The issue is a low-severity confidentiality-only flaw (CVSS 4.3, CWE-359) reachable over the network with low attack complexity but requiring a valid student account. No public exploit code or confirmed active exploitation was identified in the provided data, and an upstream fix commit (MDL-89381) is referenced but a released patched version is not independently confirmed.
Authenticated remote users of Moodle can bypass the URL downloader's host-blocking logic by encoding a restricted destination as an IPv4-mapped IPv6 address (for example ::ffff:<internal-ip>), causing the server to fetch resources from internal or otherwise blocked hosts on the attacker's behalf. Successful abuse yields Server-Side Request Forgery limited to confidentiality impact (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning the practical damage depends on what the Moodle server itself can reach - typically cloud instance-metadata endpoints or internal-only services - and is reduced on segmented networks. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but modest-priority issue that should be scheduled alongside routine patch cycles rather than treated as an emergency.
SQL injection in the third-party Socialwall course-format plugin for Moodle (versions 3.0 through 3.3) lets remote attackers inject crafted SQL through a plugin HTTP endpoint, granting high confidentiality and integrity impact on the Moodle database. The vendor-supplied CVSS of 9.8 assumes no authentication, but our assessment lowers this to a PR:L vector (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.8) because plugin endpoints in Moodle typically require a valid authenticated session - a limiting factor that remains unconfirmed from available metadata. Exploitation is not confirmed actively exploited (no CISA KEV listing), and while a public Medium write-up describes the SQLi, no public exploit code has been confirmed at time of analysis; note that the CVE description's claim of arbitrary code execution is broader than the assessed confidentiality/integrity-only impact.
Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Moodle's TeX formula editor fails to enforce adequate execution time limits when processing mimetex content, enabling authenticated users to craft malicious formulas that exhaust server resources. This resource exhaustion vulnerability can degrade application performance or trigger denial-of-service conditions without requiring user interaction or privilege escalation.
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. [CVSS 4.3 MEDIUM]
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. [CVSS 5.4 MEDIUM]
A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. [CVSS 5.4 MEDIUM]
A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. [CVSS 7.5 HIGH]
A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfully authenticated. [CVSS 3.5 LOW]
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. [CVSS 6.1 MEDIUM]
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. [CVSS 7.3 HIGH]
A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. [CVSS 7.3 HIGH]
Moodle contains a vulnerability that allows attackers to authenticate through the Learning Tools Interoperability (LTI) Provider (CVSS 8.1).
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. [CVSS 8.8 HIGH]
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. [CVSS 7.2 HIGH]
Information disclosure in the Moodle router (r.php) lets a remote unauthenticated requester receive internal directory listings when the deployment's HTTP headers are not properly configured. The flaw is scored 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with impact confined to confidentiality - exposure of internal directory and file structure - and no effect on integrity or availability. Exposure is conditional on the header misconfiguration: instances with correctly configured HTTP headers are not expected to expose the listings, and EPSS is low at 0.30% (23rd percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query parameter is passed directly to file_get_contents() without validation, allowing unauthenticated attackers to read arbitrary files from the Moodle server including configuration files with database credentials.
A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was discovered in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF). Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data-including names, contact information, and hashed passwords-via stack traces. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An SQL injection risk was identified in the module list filter within course search. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Insufficient capability checks made it possible to disable badges a user does not have permission to access. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The question bank filter required additional sanitizing to prevent a reflected XSS risk. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in moodle. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Feedback. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in Moodle's Blackboard question-import format lets an authenticated Teacher-level user copy arbitrary files readable by the web server - notably config.php, which holds database credentials and the site salt - into their own draft file area. Affected releases are 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11 and 4.5.x through 4.5.15; scoring is CVSS 4.0 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), a confidentiality-only impact gated behind existing question-import or lesson-edit rights. There is no CISA KEV listing and no confirmed working exploit code; a public Abraxas Labs research writeup describes the flaw, and the issue is prioritized for remediation this week.
Authenticated users on Moodle instances running the Configurable Reports block before 5.3.0 can read restricted SQL reports containing user and grade data by supplying arbitrary report IDs to the block_configurable_reports_get_report_data web service. The CWE-863 authorization bypass occurs because a failed check_permissions call adds only a warning and still returns the full report table, so any valid logged-in account can access reports without the required permissions when Moodle web services are enabled. Exploitation requires a valid login but no elevated role, impact is read-only confidentiality loss, and no public exploit identified at time of analysis.
Authenticated SQL injection in Moodle's question bank web service allows a low-privilege user to inject unsanitized input into database queries, potentially exposing, modifying, or deleting sensitive data in the underlying database. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid account that can reach the question bank web-service endpoint is a potential vector - exploitation by fully anonymous users is not possible, and the requirement for credentials and for the web service to be enabled/exposed are the main limiting factors. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (14th percentile), and CISA SSVC rates exploitation as none with partial technical impact; this is a credible, exploitable issue but not an emergency.
Moodle's TeX filter fails to properly sanitize administrative configuration inputs, enabling command injection on systems with ImageMagick installed. An authenticated administrator can inject arbitrary system commands through a malicious TeX filter setting, achieving code execution with the privileges of the Moodle server process. No patch is currently available, and exploitation requires administrative access but could compromise the entire Moodle installation.
Moodle's backup restore function fails to properly validate malicious backup files, allowing authenticated administrators to achieve remote code execution through crafted file processing. An attacker with restore privileges can exploit this code injection vulnerability to fully compromise the Moodle server. No patch is currently available.
A flaw was found in Moodle. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.5%.
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Enrolled students on Moodle can call the core_grades_get_gradeitems web service and receive the IDs, names, and categories of grade items that the gradebook hides from them, because the external function performs no capability check before returning the data. Confirmed affected ranges are 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0, and exploitation requires only a valid account with enrolment in a course that actually contains hidden grade items. Disclosure is limited to hidden item metadata - grade values are not exposed - and there is no CISA KEV listing and no confirmed public exploit code at time of analysis, only a third-party research write-up and the upstream source location; the issue is scored 5.3 and assessed as a moderate-severity information-disclosure problem rather than an emergency.
Non-editing teachers on affected Moodle sites can read grade feedback and identity data (names, email addresses) belonging to groups they are not enrolled in, because the core_grades_get_feedback external web service omits group-membership and enrolment checks and accepts an attacker-supplied userid. Affected branches are Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4 and 5.3.0; the only prerequisite is an authenticated account with at least the non-editing teacher role (CVSS 4.0 vector PR:L) plus reachability of the web service, after which exploitation is a matter of iterating the userid parameter. Confidentiality impact is limited (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no write, code-execution or availability effect; a public research writeup by Abraxas Labs describes the issue, but that reference is not verified as working exploit code and there is no KEV or confirmed in-the-wild exploitation.
SQL injection in Moodle's External database enrolment plugin (enrol_database) lets a user with an editing-teacher role store a backslash-quote payload in a course's idnumber field that is later executed by the scheduled enrolment sync task, allowing them to read data from and manipulate enrolment results in the linked MySQL/MariaDB external database. Only sites that have enabled and configured this non-default enrolment plugin against a MySQL or MariaDB backend are exposed; the payload fires only when the scheduled sync runs, so the attacker does not control trigger timing. No KEV listing is present and no verified working exploit code was identified at time of analysis, though a third-party research writeup is referenced; the source-level links in the advisory point to the affected code in v5.3.0 rather than to a confirmed fix.
SQL injection in the Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 allows an authenticated low-privileged user to read arbitrary database tables - including Moodle user password hashes - through the filter_var request parameter of viewreport.php. Exploitation requires that the attacker hold the capability to view a SQL-type report that was authored with the %%FILTER_VAR%% placeholder, which is why the vector carries AT:P and PR:L; impact is limited to confidentiality (C:H with I:N/A:N) and no user interaction is needed. A vendor patch is available in release 5.3.1, and no public exploit code was identified at time of analysis.
Cross-site request forgery in Moodle's XML grade import lets a remote, unauthenticated attacker set or overwrite student grades by luring a user with grade-management permissions (teacher, manager, or administrator) into visiting an attacker-controlled page while their Moodle session is active. The flaw, tracked upstream as MDL-84545 and rated CVSS 6.5, depends on user interaction and affects grade integrity only, with no confidentiality or availability impact, and no public exploit code has been identified at time of analysis. Exploitation is constrained further by the fact that the forged request only succeeds if the victim's browser still transmits Moodle session cookies cross-site, an increasingly limited condition under modern SameSite cookie defaults.
Moodle user-list filters do not enforce the same profile-field visibility restrictions that are applied when a profile is viewed directly, so an authenticated user holding manager privileges can filter user listings on hidden profile attributes and infer their values from the results returned. The issue is low severity, assessed at CVSS 3.1 base score 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), and is limited to information disclosure - there is no integrity or availability impact and no code execution path. The elevated manager role is the gating prerequisite, so the flaw is not reachable by anonymous visitors or ordinary authenticated users, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting (XSS) in Moodle's password reset page allows unauthenticated remote attackers to execute arbitrary script in a victim's browser by tricking them into opening a crafted password-reset link containing a malicious username. The flaw stems from insufficient sanitization of the username input and is assigned CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). No public exploit code or active exploitation is known at the time of analysis; an upstream fix commit (MDL-88335) is referenced but a released patched version is not independently confirmed.
An authenticated teacher in Moodle can add users to groups that belong to courses they are not authorized to manage, because the enrol-user-into-course-with-group-assignment workflow fails to verify that the supplied group actually belongs to the target course. The flaw is a low-severity authorization weakness (CVSS 4.3, CWE-842, Placement into Incorrect Group) that requires a valid teacher-level account (PR:L) and causes only limited integrity impact to group membership; no public exploit code was identified and there is no evidence of active exploitation at time of analysis. Confidentiality and availability are unaffected, so the practical risk is unauthorized group placement and possible exposure of course-group context rather than data theft or service disruption.
Missing capability check in Moodle's grade-penalty recalculation routine allows any authenticated low-privileged user to trigger unauthorized recalculation and modify grade penalty records, potentially altering student assessment scores. The flaw requires a valid Moodle account but no additional user interaction; it is not known to be actively exploited, and no public exploit code has been identified at time of analysis. Impact is limited to integrity of grade-penalty data with no confidentiality or availability impact.
Authenticated users on Moodle instances with the AI image-generation web service enabled can bypass capability checks to invoke the feature without proper authorization, leading to unauthorized use of AI image generation. This low-severity authorization flaw (CWE-425) requires a valid Moodle account but not the specific capability normally required, and the AI subsystem must be configured; it enables quota/cost abuse but no data disclosure or code execution. No public exploit code or active exploitation is known at time of analysis, and the assessed CVSS is 2.7 with PR:L.
Direct URL access to Moodle's manual enrolment management page allows authenticated users who already hold enrolment-management permissions to modify manual enrolments even after an administrator has disabled the manual enrolment plugin in the UI. The issue is a forced-browsing access-control weakness rated low real risk with integrity-only impact: it does not let unauthenticated or ordinary users exploit it, read data, or escalate privileges. No public exploit identified at time of analysis, and no CISA KEV entry was reported.
Stored cross-site scripting in Moodle's forum post rendering templates allows an authenticated user with forum posting rights - typically any enrolled student or participant - to embed malicious markup in a forum post that executes in the browser of another user who views that post. Exploitation requires a valid low-privileged account (CVSS PR:L) plus victim interaction (UI:R), so it is not self-contained and depends on a second user opening the affected discussion; impact is confined to the victim's browser session, with partial confidentiality and integrity loss and no availability impact (moderate severity, CVSS 3.1 base 4.6). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but upstream fix commits referencing MDL-88981 are already public, which lowers the effort needed to reproduce the issue.
Authenticated Moodle users who hold Report Builder audience-management permissions can abuse an improperly validated audience class name to instantiate arbitrary internal PHP classes, producing unexpected internal objects and altered application behavior (CWE-470, unsafe reflection). The vendor and independent assessment both rate real-world risk as low: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N (score 2.2), because reaching the flaw requires a semi-privileged authenticated account able to create or manage Report Builder audiences, and the attack is rated high complexity with no victim interaction. Impact is bounded to integrity - no confidentiality or availability effect is described - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Moodle's grade web service allows an authenticated student to view profile details of other students enrolled in the same course even though they lack the required capability. The issue is a low-severity confidentiality-only flaw (CVSS 4.3, CWE-359) reachable over the network with low attack complexity but requiring a valid student account. No public exploit code or confirmed active exploitation was identified in the provided data, and an upstream fix commit (MDL-89381) is referenced but a released patched version is not independently confirmed.
Authenticated remote users of Moodle can bypass the URL downloader's host-blocking logic by encoding a restricted destination as an IPv4-mapped IPv6 address (for example ::ffff:<internal-ip>), causing the server to fetch resources from internal or otherwise blocked hosts on the attacker's behalf. Successful abuse yields Server-Side Request Forgery limited to confidentiality impact (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning the practical damage depends on what the Moodle server itself can reach - typically cloud instance-metadata endpoints or internal-only services - and is reduced on segmented networks. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but modest-priority issue that should be scheduled alongside routine patch cycles rather than treated as an emergency.
SQL injection in the third-party Socialwall course-format plugin for Moodle (versions 3.0 through 3.3) lets remote attackers inject crafted SQL through a plugin HTTP endpoint, granting high confidentiality and integrity impact on the Moodle database. The vendor-supplied CVSS of 9.8 assumes no authentication, but our assessment lowers this to a PR:L vector (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.8) because plugin endpoints in Moodle typically require a valid authenticated session - a limiting factor that remains unconfirmed from available metadata. Exploitation is not confirmed actively exploited (no CISA KEV listing), and while a public Medium write-up describes the SQLi, no public exploit code has been confirmed at time of analysis; note that the CVE description's claim of arbitrary code execution is broader than the assessed confidentiality/integrity-only impact.
Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Moodle's TeX formula editor fails to enforce adequate execution time limits when processing mimetex content, enabling authenticated users to craft malicious formulas that exhaust server resources. This resource exhaustion vulnerability can degrade application performance or trigger denial-of-service conditions without requiring user interaction or privilege escalation.
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. [CVSS 4.3 MEDIUM]
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. [CVSS 5.4 MEDIUM]
A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. [CVSS 5.4 MEDIUM]
A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. [CVSS 7.5 HIGH]
A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfully authenticated. [CVSS 3.5 LOW]
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. [CVSS 6.1 MEDIUM]
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. [CVSS 7.3 HIGH]
A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. [CVSS 7.3 HIGH]
Moodle contains a vulnerability that allows attackers to authenticate through the Learning Tools Interoperability (LTI) Provider (CVSS 8.1).
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. [CVSS 8.8 HIGH]
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. [CVSS 7.2 HIGH]
Information disclosure in the Moodle router (r.php) lets a remote unauthenticated requester receive internal directory listings when the deployment's HTTP headers are not properly configured. The flaw is scored 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with impact confined to confidentiality - exposure of internal directory and file structure - and no effect on integrity or availability. Exposure is conditional on the header misconfiguration: instances with correctly configured HTTP headers are not expected to expose the listings, and EPSS is low at 0.30% (23rd percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query parameter is passed directly to file_get_contents() without validation, allowing unauthenticated attackers to read arbitrary files from the Moodle server including configuration files with database credentials.
A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was discovered in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.
A flaw was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF). Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data-including names, contact information, and hashed passwords-via stack traces. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An SQL injection risk was identified in the module list filter within course search. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Insufficient capability checks made it possible to disable badges a user does not have permission to access. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The question bank filter required additional sanitizing to prevent a reflected XSS risk. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Moodle. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Moodle. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in moodle. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in moodle. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Feedback. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.