Skip to content
OpenAdvisories
Medium WID-SEC-2026-3686 4 CVEs

Moodle: Mehrere Schwachstellen

Published Sep 30, 2026 · Updated Sep 30, 2026 · de-DE

Platform: Android Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Dateien zu manipulieren, Daten offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.

Vulnerabilities 4

  • Medium 6.5
    CVE-2026-102588

    Moodle: csrf in xml grade import

    A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthoriz…

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-102585

    Moodle: group validation missing when enrolling user to course

    A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw …

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-102586

    Moodle: xss via password reset link due to insufficient username escaping

    A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link…

    moodle Web / CMS Ubuntu
  • Low 2.7
    CVE-2026-102587

    Moodle: user list filters bypass profile field visibility

    A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting …

    moodle Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References