Skip to content
OpenAdvisories

Package · Packagist

moodle/moodle

437 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-5546 Public exploit

    Moodle: stored xss in quiz grading report via user id number

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2023-30943 Public exploit Scanner template

    Moodle: tinymce loaders susceptible to arbitrary folder creation

    The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25627 Public exploit

    Moodle stored Cross-site Scripting (XSS)

    The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2019-3847 Public exploit

    Moodle XSS Vulnerability

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to t…

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2019-3810 Public exploit EPSS 14%

    Moodle XSS Vulnerability

    A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2018-16854 Public exploit

    Moodle Login CSRF vulnerability in login form

    A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2018-1042 Public exploit EPSS 16%

    Moodle SSRF Vulnerability

    Moodle 3.x has Server Side Request Forgery in the filepicker.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium —
    CVE-2013-3630 Public exploit EPSS 42%

    Moodle Authenticated Spelling Binary Remote Code Execution

    Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.

    moodle/moodle moodle Ubuntu Packagist
  • Medium —
    CVE-2011-4280 Public exploit

    Moodle vulnerable to XSS via bundled spikephpcoverage library

    Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    moodle/moodle Packagist