26 results · Clear filters · Feed
-
High 7.5CVE-2025-32044 Public exploit
Moodle: unauthenticated rest api user data exposure
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with z…
-
High 8.3CVE-2025-26529 Public exploit
Stored XSS risk in admin live log
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
-
High 8.1
Moodle: remote code execution via calculated question types
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
-
Medium 4.3CVE-2023-5546 Public exploit
Moodle: stored xss in quiz grading report via user id number
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
-
Medium 6.5
Moodle: tinymce loaders susceptible to arbitrary folder creation
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
-
Critical 9.8CVE-2021-36394 Public exploit
Moodle Session Fixation vulnerability
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
-
Critical 9.8
Moodle SQL Injection vulnerability
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
-
High 7.5CVE-2021-36396 Public exploit
Moodle vulnerable to Server-Side Request Forgery
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
-
High 8.8
Moodle Incorrect Authorization vulnerability
In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.
-
High 7.5
Moodle Arbitrary file read when importing lesson questions
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks.…
-
Critical 9.8CVE-2022-35649 Public exploit
Moodle PostScript Code Injection
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation…
-
Critical 9.8CVE-2022-30600 Public exploit
Incorrect Calculation in moodle
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
-
Critical 9.8
SQL injection in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
-
High 8.2
Moodle command execution vulnerability exists in the default legacy spellchecker plugin
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
-
Medium 6.1CVE-2020-25627 Public exploit
Moodle stored Cross-site Scripting (XSS)
The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.
-
Medium 5.4CVE-2019-3847 Public exploit
Moodle XSS Vulnerability
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to t…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …
-
Medium 6.5CVE-2018-16854 Public exploit
Moodle Login CSRF vulnerability in login form
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
-
High 8.8
Moodle calculated question type allows remote code execution by Question authors
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
-
Medium 6.5
Moodle SSRF Vulnerability
Moodle 3.x has Server Side Request Forgery in the filepicker.
-
Critical 9.8
Moodle SQL injection via user preferences
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
-
Low —CVE-2015-2269 Public exploit
Moodle XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2…
-
Low —CVE-2014-3544 Public exploit
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype I…
-
Low —CVE-2014-3551 Public exploit
Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web s…
-
Medium —
Moodle Authenticated Spelling Binary Remote Code Execution
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
-
Medium —CVE-2011-4280 Public exploit
Moodle vulnerable to XSS via bundled spikephpcoverage library
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.