Skip to content
OpenAdvisories

Package · Ubuntu

moodle

323 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-102578 Public exploit

    Moodle: sql injection in question bank web service

    A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an a…

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-5546 Public exploit

    Moodle: stored xss in quiz grading report via user id number

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2023-30943 Public exploit Scanner template

    Moodle: tinymce loaders susceptible to arbitrary folder creation

    The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25627 Public exploit

    Moodle stored Cross-site Scripting (XSS)

    The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2019-3847 Public exploit

    Moodle XSS Vulnerability

    A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to t…

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2019-3810 Public exploit EPSS 14%

    Moodle XSS Vulnerability

    A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2018-16854 Public exploit

    Moodle Login CSRF vulnerability in login form

    A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

    [UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2018-1042 Public exploit EPSS 16%

    Moodle SSRF Vulnerability

    Moodle 3.x has Server Side Request Forgery in the filepicker.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium —
    CVE-2013-3630 Public exploit EPSS 42%

    Moodle Authenticated Spelling Binary Remote Code Execution

    Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.

    moodle/moodle moodle Ubuntu Packagist