Filtered by vendor Moodle
Subscribe
Total
630 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-43429 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 5.3 MEDIUM |
|
A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.
|
|||||
| CVE-2024-43427 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 3.7 LOW |
|
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
|
|||||
| CVE-2024-43440 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 7.5 HIGH |
|
A flaw was found in moodle. A local file may include risks when restoring block backups.
|
|||||
| CVE-2024-43434 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 8.1 HIGH |
|
The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.
|
|||||
| CVE-2024-43431 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 7.5 HIGH |
|
A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.
|
|||||
| CVE-2024-43428 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 7.7 HIGH |
|
To address a cache poisoning risk in Moodle, additional validation for local storage was required.
|
|||||
| CVE-2024-43425 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 8.1 HIGH |
|
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
|
|||||
| CVE-2024-34004 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 6.5 MEDIUM |
|
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
|
|||||
| CVE-2024-34005 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 6.5 MEDIUM |
|
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
|
|||||
| CVE-2024-34003 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 5.9 MEDIUM |
|
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
|
|||||
| CVE-2024-34002 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 6.5 MEDIUM |
|
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
|
|||||
| CVE-2024-28593 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 5.4 MEDIUM |
|
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be removed from standard Moodle."
|
|||||
| CVE-2024-29374 | 1 Moodle | 1 Moodle | 2025-05-01 | N/A | 6.1 MEDIUM |
|
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
|
|||||
| CVE-2024-38275 | 1 Moodle | 1 Moodle | 2025-04-30 | N/A | 7.5 HIGH |
|
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
|
|||||
| CVE-2022-45152 | 2 Fedoraproject, Moodle | 3 Extra Packages For Enterprise Linux, Fedora, Moodle | 2025-04-29 | N/A | 9.1 CRITICAL |
|
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.
|
|||||
| CVE-2022-45151 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-04-25 | N/A | 5.4 MEDIUM |
|
The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
|
|||||
| CVE-2022-45150 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-04-25 | N/A | 6.1 MEDIUM |
|
A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.
|
|||||
| CVE-2022-45149 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-04-25 | N/A | 5.4 MEDIUM |
|
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
|
|||||
| CVE-2024-43437 | 1 Moodle | 1 Moodle | 2025-04-23 | N/A | 5.4 MEDIUM |
|
A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.
|
|||||
| CVE-2024-43439 | 1 Moodle | 1 Moodle | 2025-04-23 | N/A | 5.4 MEDIUM |
|
A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.
|
|||||
| CVE-2017-2643 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.0 MEDIUM | 5.3 MEDIUM |
|
In Moodle 3.2.x, global search displays user names for unauthenticated users.
|
|||||
| CVE-2016-8644 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.0 MEDIUM | 5.3 MEDIUM |
|
In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.
|
|||||
| CVE-2017-7490 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.0 MEDIUM | 5.3 MEDIUM |
|
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
|
|||||
| CVE-2017-2644 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.3 MEDIUM | 6.1 MEDIUM |
|
In Moodle 3.x, XSS can occur via evidence of prior learning.
|
|||||
| CVE-2017-2578 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.3 MEDIUM | 6.1 MEDIUM |
|
In Moodle 3.x, there is XSS in the assignment submission page.
|
|||||
| CVE-2016-3729 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.0 MEDIUM | 6.5 MEDIUM |
|
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.
|
|||||
| CVE-2017-15110 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.0 MEDIUM | 4.3 MEDIUM |
|
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.
|
|||||
| CVE-2017-7531 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.0 MEDIUM | 4.3 MEDIUM |
|
In Moodle 3.3, the course overview block reveals activities in hidden courses.
|
|||||
| CVE-2016-3731 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.0 MEDIUM | 5.3 MEDIUM |
|
Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.
|
|||||
| CVE-2017-12157 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.0 MEDIUM | 4.3 MEDIUM |
|
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
|
|||||
| CVE-2017-2642 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.0 MEDIUM | 6.5 MEDIUM |
|
Moodle 3.x has user fullname disclosure on the user preferences page.
|
|||||
| CVE-2016-5012 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.0 MEDIUM | 5.3 MEDIUM |
|
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
|
|||||
| CVE-2017-7491 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.3 MEDIUM | 4.3 MEDIUM |
|
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
|
|||||
| CVE-2016-5013 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.8 MEDIUM | 5.4 MEDIUM |
|
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
|
|||||
| CVE-2016-5014 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.8 MEDIUM | 5.4 MEDIUM |
|
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
|
|||||
| CVE-2017-2645 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.3 MEDIUM | 6.1 MEDIUM |
|
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.
|
|||||
| CVE-2017-2576 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.0 MEDIUM | 5.3 MEDIUM |
|
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
|
|||||
| CVE-2016-3734 | 1 Moodle | 1 Moodle | 2025-04-20 | 6.8 MEDIUM | 8.8 HIGH |
|
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
|
|||||
| CVE-2016-3732 | 1 Moodle | 1 Moodle | 2025-04-20 | 4.0 MEDIUM | 4.3 MEDIUM |
|
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
|
|||||
| CVE-2016-7038 | 1 Moodle | 1 Moodle | 2025-04-20 | 5.0 MEDIUM | 7.3 HIGH |
|
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
|
|||||