moodle/moodle Security Advisories for v2.7.0-rc2 (227)
-
[HIGH] Moodle has a Remote Code Execution risk via file restore
PKSA-fh6z-73jv-qwnd CVE-2026-26045 GHSA-ggxq-2mg9-8966
Affected version: <4.5.9|>=5.0.0-beta,<5.0.5|>=5.1.0-beta,<5.1.2
Reported by:
GitHub -
[MEDIUM] Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits
PKSA-d5fc-2jw8-sm45 CVE-2026-26047 GHSA-cg8j-5cr2-568q
Affected version: <4.5.9|>=5.0.0-beta,<5.0.5|>=5.1.0-beta,<5.1.2
Reported by:
GitHub -
[LOW] Moodle Open Redirect vulnerability
PKSA-prf5-y5p2-ykmg CVE-2025-67852 GHSA-qv78-6gpp-hm68
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[HIGH] Moodle Affected by Improper Restriction of Excessive Authentication Attempts
PKSA-dz6d-pdgm-m472 CVE-2025-67853 GHSA-5cx4-w4fh-fr57
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to Cross-site Scripting
PKSA-2j87-1r5d-n19k CVE-2025-67855 GHSA-vwhw-vp9v-q9c9
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[MEDIUM] Moodle has an authorization logic flaw
PKSA-xyd9-vffd-bswp CVE-2025-67856 GHSA-hcm6-q6pc-xfhm
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[MEDIUM] Moodle Inserts Sensitive Information Into Sent Data
PKSA-2wxn-vc4s-1dkz CVE-2025-67857 GHSA-8jrv-wx83-w3xj
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[HIGH] Moodle authentication bypass vulnerability
PKSA-d2w7-632f-6wy9 CVE-2025-67848 GHSA-j5jv-w5cw-j9ff
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[HIGH] Moodle Cross-site Scripting (XSS) vulnerability
PKSA-qhxz-6rtn-nzx7 CVE-2025-67849 GHSA-mhf6-pp52-8wqj
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[HIGH] Moodle vulnerable to Cross-site Scripting
PKSA-3g2p-wb92-w82j CVE-2025-67850 GHSA-6mmv-f6c6-v6q8
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[MEDIUM] Moodle formula injection vulnerability
PKSA-213q-p3b4-49zj CVE-2025-67851 GHSA-qfh6-h7j6-fvjv
Affected version: >=5.1.0-beta,<5.1.1|>=5.0.0-beta,<5.0.4|>=4.5.0-beta,<4.5.8|>=4.4.0-beta,<4.4.12|<4.1.22
Reported by:
GitHub -
[HIGH] Moodle affected by a code injection vulnerability
PKSA-41tm-5zq3-pfdc CVE-2025-67847 GHSA-xvmh-25jw-gmmm
Affected version: <4.1.22|>=4.2.0-beta,<4.4.12|>=4.5.0-beta,<4.5.8|>=5.0.0-beta,<5.0.4|>=5.1.0-beta,<5.1.1
Reported by:
GitHub -
[HIGH] Moodle vulnerable to brute-force password guesses
PKSA-c2fh-btt6-h7g6 CVE-2025-62399 GHSA-m58f-9pvv-8mp2
Affected version: <4.1.21|>=4.2.0-beta,<4.4.11|>=4.5.0-beta,<4.5.7|>=5.0.0-beta,<5.0.3
Reported by:
GitHub -
[MEDIUM] Moodle exposed the names of hidden groups to users
PKSA-7bbm-2bcq-7hnc CVE-2025-62400 GHSA-422v-w6c5-vq42
Affected version: <4.1.21|>=4.2.0-beta,<4.4.11|>=4.5.0-beta,<4.5.7|>=5.0.0-beta,<5.0.3
Reported by:
GitHub -
[MEDIUM] Moodle has a time restriction bypass
PKSA-2154-mt94-234t CVE-2025-62401 GHSA-w29j-8phw-ffjf
Affected version: <4.1.21|>=4.2.0-beta,<4.4.11|>=4.5.0-beta,<4.5.7|>=5.0.0-beta,<5.0.3
Reported by:
GitHub -
[MEDIUM] Moodle allows IDOR when accessing the cohorts report
PKSA-bctf-nmjy-ynnz CVE-2025-3647 GHSA-34g7-pg9j-pxgp
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[LOW] Moodle has a CSRF risk in user tours manager that allows tour duplication
PKSA-jwzm-wkm8-x9qp CVE-2025-3635 GHSA-88xj-97gf-7wpq
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[MEDIUM] Moodle allows IDOR in RSS block, which allows access to additional RSS feeds
PKSA-848d-b4jc-r4z3 CVE-2025-3636 GHSA-chmf-m33p-ph8m
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[LOW] Moodle's mod_data edit/delete pages pass CSRF token in GET parameter
PKSA-fvfh-pt1s-3tmx CVE-2025-3637 GHSA-9vc3-vm42-fjhm
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[LOW] Moodle has a CSRF risk in Brickfield tool's analysis request action
PKSA-ysbw-mxpt-3wtx CVE-2025-3638 GHSA-m8qh-hx4c-h9hr
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[MEDIUM] Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users
PKSA-mj2r-6dr9-xghp CVE-2025-3640 GHSA-6g5x-h5x7-q4mq
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[HIGH] Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository
PKSA-9jfc-tg5h-yj5b CVE-2025-3641 GHSA-c8v6-vxhf-wcrr
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[HIGH] Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository
PKSA-8gd9-7npk-ym55 CVE-2025-3642 GHSA-m367-445c-2xqr
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[MEDIUM] Moodle has reflected Cross-site Scripting risk in policy tool
PKSA-8sfx-6cpy-w558 CVE-2025-3643 GHSA-hxgg-4qww-85ph
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[MEDIUM] Moodle's AJAX section delete does not respect course_can_delete_section()
PKSA-g3j3-qxjm-3zq6 CVE-2025-3644 GHSA-cpm7-mv33-jwf8
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[MEDIUM] Moodle has an IDOR in messaging web service which allows access to some user details
PKSA-pr46-vm59-kn4p CVE-2025-3645 GHSA-pj96-xh2w-fgqx
Affected version: >=4.5.0-beta,<4.5.4|>=4.4.0-beta,<4.4.8|>=4.3.0-beta,<4.3.12|<4.1.18
Reported by:
GitHub -
[MEDIUM] Moodle shows hidden grades to users without permission on some grade reports
PKSA-d7vn-pt6b-zj2h CVE-2025-32045 GHSA-8m7c-hm88-2p97
Affected version: >=4.5.0-beta,<4.5.3|>=4.4.0-beta,<4.4.7|>=4.3.0-beta,<4.3.11|<4.1.17
Reported by:
GitHub -
[HIGH] Moodle has an arbitrary file read risk through pdfTeX
PKSA-tbqf-gy2t-9549 CVE-2025-26525 GHSA-4hmr-39vp-xfrr
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[MEDIUM] Moodle's feedback response viewing and deletions did not respect Separate Groups mode
PKSA-1xfj-78ck-68m3 CVE-2025-26526 GHSA-pxg4-xjp7-w9c5
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[MEDIUM] Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block
PKSA-zx9m-rnqj-bycy CVE-2025-26527 GHSA-5r85-6h7f-rg3r
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[LOW] Moodle has a stored XSS in ddimageortext question type
PKSA-19h3-t8f4-j9qr CVE-2025-26528 GHSA-h697-w4ph-7pcx
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[HIGH] Moodle has a stored XSS risk in admin live log
PKSA-bqpz-gp92-yhbn CVE-2025-26529 GHSA-wr88-x8cm-7cgq
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[LOW] Moodle has an IDOR in badges allows disabling of arbitrary badges
PKSA-6qw2-86sq-nszm CVE-2025-26531 GHSA-g88w-v4cq-qgcp
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[LOW] Moodle allows teachers to evade trusttext config when restoring glossary entries
PKSA-2t2j-mwq1-3v3v CVE-2025-26532 GHSA-cw24-f6fq-7j9v
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[HIGH] Moodle has a SQL injection risk in course search module list filter
PKSA-6vk5-pjgr-yssn CVE-2025-26533 GHSA-rg56-94j7-hjx9
Affected version: <4.1.16|>=4.3.0-beta,<4.3.10|>=4.4.0-beta,<4.4.6|>=4.5.0-beta,<4.5.2
Reported by:
GitHub -
[MEDIUM] Moodle allows users to retrieve information they did not have permission to access
PKSA-wjgr-krfv-d7mf CVE-2024-45689 GHSA-j822-x5gg-5r56
Affected version: >=4.4.0-beta,<4.4.3|>=4.3.0-beta,<4.3.7|>=4.2.0-beta,<4.2.10|<4.1.13
Reported by:
GitHub -
[MEDIUM] Moodle IDOR when deleting OAuth2 linked accounts
PKSA-qgvt-ww2j-46z8 CVE-2024-45690 GHSA-fhg2-r2h9-h7q8
Affected version: >=4.4.0-beta,<4.4.3|>=4.3.0-beta,<4.3.7|>=4.2.0-beta,<4.2.10|<4.1.13
Reported by:
GitHub -
[MEDIUM] Moodle Lesson activity password bypass through PHP loose comparison
PKSA-y22b-yrq9-2frq CVE-2024-45691 GHSA-xfv7-h2qg-rjm7
Affected version: >=4.4.0-beta,<4.4.3|>=4.3.0-beta,<4.3.7|>=4.2.0-beta,<4.2.10|<4.1.13
Reported by:
GitHub -
[MEDIUM] Moodle leaks user names
PKSA-rd93-2zrq-9hms CVE-2024-48896 GHSA-cq5f-wv7p-5gfc
Affected version: >=4.4.0,<4.4.4|>=4.3.0,<4.3.8|>=4.2.0,<4.2.11|<4.1.14
Reported by:
GitHub -
[MEDIUM] moodle: IDOR in edit/delete RSS feed
PKSA-hhpt-69ky-ds9w CVE-2024-48897 GHSA-x3x9-349x-2485
Affected version: >=4.4.0,<4.4.4|>=4.3.0,<4.3.8|>=4.2.0,<4.2.11|<4.1.14
Reported by:
GitHub -
[MEDIUM] moodle: Some users can delete audiences of other reports
PKSA-sbzz-bvbt-7fqv CVE-2024-48898 GHSA-fjq9-452g-jg3q
Affected version: >=4.4.0,<4.4.4|>=4.3.0,<4.3.8|>=4.2.0,<4.2.11|<4.1.14
Reported by:
GitHub -
[MEDIUM] moodle: IDOR when fetching report schedules
PKSA-b9zz-v9f7-k18v CVE-2024-48901 GHSA-mg54-p2wj-5ph7
Affected version: >=4.4.0,<4.4.4|>=4.3.0,<4.3.8|>=4.2.0,<4.2.11|<4.1.14
Reported by:
GitHub -
[MEDIUM] Moodle reflected XSS via H5P error message
PKSA-gdvk-459t-n53y CVE-2024-43439 GHSA-hjgc-jxjc-8v9j
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[LOW] Moodle Cross-site Scripting vulnerability
PKSA-g8yy-dfw9-yn61 CVE-2024-43437 GHSA-4hjf-6pxr-549h
Affected version: <4.1.12|>=4.2.0,<4.2.9|>=4.3.0,<4.3.6|>=4.4.0,<4.4.2
Reported by:
GitHub -
[LOW] Moodle admin presets export tool includes some secrets that should not be exported
PKSA-vng5-wdz1-h5s8 CVE-2024-43427 GHSA-vpq5-56jj-vf2m
Affected version: <4.1.12|>=4.2.0,<4.2.9|>=4.3.0,<4.3.6|>=4.4.0,<4.4.2
Reported by:
GitHub -
[LOW] Moodle has user information visibility control issues in gradebook reports
PKSA-zdyc-3cpq-dzhz CVE-2024-43429 GHSA-c767-4whh-v7rw
Affected version: <4.1.12|>=4.2.0,<4.2.9|>=4.3.0,<4.3.6|>=4.4.0,<4.4.2
Reported by:
GitHub -
[LOW] Moodle authorization headers preserved between "emulated redirects"
PKSA-76sy-6846-dkkc CVE-2024-43432 GHSA-7wmp-2xmx-g6h8
Affected version: <4.1.12|>=4.2.0,<4.2.9|>=4.3.0,<4.3.6|>=4.4.0,<4.4.2
Reported by:
GitHub -
[LOW] Moodle has insufficient capability checks
PKSA-52b5-bb1k-6tvt CVE-2024-43435 GHSA-4gq2-x5w4-7hp8
Affected version: <4.1.12|>=4.2.0,<4.2.9|>=4.3.0,<4.3.6|>=4.4.0,<4.4.2
Reported by:
GitHub -
[HIGH] Moodle Remote Code Execution vulnerability
PKSA-b5gd-xb9k-3r4v CVE-2024-43425 GHSA-v6f4-v8h8-3c87
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[MEDIUM] Moodle has arbitrary file read risk through pdfTeX
PKSA-c8xb-byc5-1chb CVE-2024-43426 GHSA-vjmm-r9gg-425m
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to cache poisoning via injection into storage
PKSA-wg88-91px-2xxt CVE-2024-43428 GHSA-2r9m-wg35-rfvc
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[MEDIUM] Moodle's IDOR in badges allows deletion of arbitrary badges
PKSA-rxzs-qrdh-wvnm CVE-2024-43431 GHSA-wwjf-gwrv-wh45
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[HIGH] Moodle has CSRF risk in Feedback non-respondents report
PKSA-sw85-d8w2-2fxq CVE-2024-43434 GHSA-x87r-37q5-mmr8
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to site administration SQL injection via XMLDB editor
PKSA-sbn5-p35x-1nwr CVE-2024-43436 GHSA-mx26-62xm-2p83
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[MEDIUM] Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users
PKSA-yzps-6hch-gh72 CVE-2024-43438 GHSA-p9cx-f595-h79h
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[MEDIUM] Moodle LFI vulnerability when restoring malformed block backups
PKSA-9732-nw42-9zsm CVE-2024-43440 GHSA-qrqv-26gf-xgwh
Affected version: >=4.4.0-beta,<4.4.2|>=4.3.0-beta,<4.3.6|>=4.2.0-beta,<4.2.9|<4.1.12
Reported by:
GitHub -
[MEDIUM] Moodle BigBlueButton web service leaks meeting joining information
PKSA-pnzk-r5zq-ynpf CVE-2024-38273 GHSA-x29x-qwvx-fxr2
Affected version: <4.1.11|>=4.2.0-beta,<4.2.8|>=4.3.0-beta,<4.3.5|>=4.4.0-beta,<4.4.1
Reported by:
GitHub -
[MEDIUM] Moodle stored XSS via calendar's event title when deleting the event
PKSA-gstb-chkw-qtcd CVE-2024-38274 GHSA-p5cg-6rfr-6mx8
Affected version: <4.1.11|>=4.2.0-beta,<4.2.8|>=4.3.0-beta,<4.3.5|>=4.4.0-beta,<4.4.1
Reported by:
GitHub -
[MEDIUM] Moodle HTTP authorization header is preserved between "emulated redirects"
PKSA-g3r1-2nj3-qn37 CVE-2024-38275 GHSA-p2cj-86v4-7782
Affected version: <4.1.11|>=4.2.0-beta,<4.2.8|>=4.3.0-beta,<4.3.5|>=4.4.0-beta,<4.4.1
Reported by:
GitHub -
[MEDIUM] Moodle CSRF risks due to misuse of confirm_sesskey
PKSA-pwh8-w7s1-zt49 CVE-2024-38276 GHSA-356g-7x36-7m34
Affected version: <4.1.11|>=4.2.0-beta,<4.2.8|>=4.3.0-beta,<4.3.5|>=4.4.0-beta,<4.4.1
Reported by:
GitHub -
[MEDIUM] Moodle uses the same key for QR login and auto-login
PKSA-my4y-h475-7mp5 CVE-2024-38277 GHSA-r82w-3phg-qvr4
Affected version: <4.1.11|>=4.2.0-beta,<4.2.8|>=4.3.0-beta,<4.3.5|>=4.4.0-beta,<4.4.1
Reported by:
GitHub -
[HIGH] Moodle Authenticated LFI risk in some misconfigured shared hosting environments
PKSA-kkys-npvt-jjkp CVE-2024-34002 GHSA-mm9p-xwfm-3fqf
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Moodle Authenticated LFI risk in some misconfigured shared hosting environments
PKSA-yhpg-hcpg-vd71 CVE-2024-34003 GHSA-jg4f-8w9x-jv35
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Moodle Authenticated LFI risk in some misconfigured shared hosting environments
PKSA-ypnv-pv4y-khkt CVE-2024-34004 GHSA-q3cm-ccrm-2mr6
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[HIGH] Moodle Authenticated LFI risk in some misconfigured shared hosting environments
PKSA-7g9b-96vb-f88b CVE-2024-34005 GHSA-r99q-hmqv-xw8w
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Moodle Unsanitized HTML in site log for config_log_created
PKSA-81r7-dyqg-4q32 CVE-2024-34006 GHSA-vvh5-7v3m-j3mj
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[HIGH] Moodle CSRF risk in analytics management of models
PKSA-1bk8-gsry-b156 CVE-2024-34008 GHSA-68x5-4jg5-gjgg
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[HIGH] Moodle CSRF risk in admin preset tool management of presets
PKSA-smf8-81d7-1g8y CVE-2024-34001 GHSA-gq9f-8rj4-w7jc
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting (XSS)
PKSA-44sz-9c8d-byh6 CVE-2024-34000 GHSA-8qwh-4vwv-7c5m
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Moodle broken access control when setting calendar event type
PKSA-xxjw-syx2-dc4w CVE-2024-33996 GHSA-4qww-rxq6-x7gf
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Moodle stored Cross-site Scripting (XSS)
PKSA-psg4-6cnq-2vpv CVE-2024-33997 GHSA-9qgq-93c7-9hm4
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting (XSS)
PKSA-1vcw-7pbp-4hc4 CVE-2024-33998 GHSA-xqhh-253w-4q5f
Affected version: <4.1.10|>=4.2.0,<4.2.7|>=4.3.0,<4.3.4
Reported by:
GitHub -
[MEDIUM] Cross-site Scripting in Moodle Chat
PKSA-dkf4-gr8b-q7z7 CVE-2024-28593 GHSA-f6mh-79vh-2hv7
Affected version: <=4.3.3
Reported by:
GitHub -
[MEDIUM] Cross site scripting in moodle
PKSA-9nns-8wdb-8pky CVE-2024-29374 GHSA-3qw5-v9cc-v262
Affected version: <=3.10.9
Reported by:
GitHub -
[HIGH] Uncontrolled Resource Consumption in moodle
PKSA-cnq3-npb7-81gr CVE-2024-25978 GHSA-487g-3m3v-hjhq
Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3
Reported by:
GitHub -
[MEDIUM] Improper Handling of Parameters in moodle
PKSA-8zq5-86tq-npgn CVE-2024-25979 GHSA-6vjf-48fh-vxxj
Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3
Reported by:
GitHub -
[MEDIUM] Improper Access Control in moodle
PKSA-q882-vvk2-55y5 CVE-2024-25980 GHSA-cp8m-h777-g4p3
Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3
Reported by:
GitHub -
[MEDIUM] Improper Access Control in moodle
PKSA-1rtr-36p9-m5t2 CVE-2024-25981 GHSA-jfrg-9hpq-9hvp
Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3
Reported by:
GitHub -
[HIGH] Cross-Site Request Forgery in moodle
PKSA-ywdp-r6kr-8xch CVE-2024-25982 GHSA-7pjp-fm93-p6pj
Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3
Reported by:
GitHub -
[MEDIUM] Authorization Bypass in moodle
PKSA-yn3d-by8g-nzfj CVE-2024-25983 GHSA-9r26-5w88-qhp9
Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3
Reported by:
GitHub -
[MEDIUM] Moodle Improper Access Control vulnerability
PKSA-57rb-5xt6-dhwq CVE-2024-1439 GHSA-5p2x-8427-9fgp
Affected version: <=4.2.0
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting vulnerability
PKSA-nw4f-rh34-rrdv CVE-2023-5544 GHSA-j5xf-gv89-g422
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability
PKSA-qmp2-c2q6-ys9x CVE-2023-5545 GHSA-26fg-v32r-h663
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting vulnerability
PKSA-hc6s-n6ty-9y9s CVE-2023-5547 GHSA-9gqp-3g28-w9xc
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability
PKSA-7z8c-xy4p-1ctc CVE-2023-5548 GHSA-cwh2-q44x-5w3c
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Improper Access Control vulnerability
PKSA-hfk2-p537-bfvp CVE-2023-5549 GHSA-fm5h-58g2-4m3f
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Code Injection vulnerability
PKSA-4qqg-7p6g-qrrf CVE-2023-5550 GHSA-5cvx-cwpx-9rjh
Affected version: <3.9.24|>=3.10.0,<3.11.17|>=4.0.0,<4.0.11|>=4.1.0,<4.1.6|>=4.2.0,<4.2.3|>=4.3.0-beta,<4.3.0-rc2
Reported by:
GitHub -
[LOW] Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability
PKSA-6cjp-j4yt-m8jy CVE-2023-5551 GHSA-jr83-8x65-xcr5
Affected version: <3.9.24|>=3.10.0,<3.11.17|>=4.0.0,<4.0.11|>=4.1.0,<4.1.6|>=4.2.0,<4.2.3|>=4.3.0-beta,<4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Code Injection vulnerability
PKSA-fmy8-x52s-r4tc CVE-2023-5539 GHSA-3xxm-3g3c-w579
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[HIGH] Moodle Code Injection vulnerability
PKSA-9gb6-31c6-p6xb CVE-2023-5540 GHSA-w8x2-w4qr-v3x4
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting vulnerability
PKSA-71dn-fkh5-k7hn CVE-2023-5541 GHSA-28gc-4qq5-8q26
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Improper Access Control vulnerability
PKSA-d458-bwfk-smkv CVE-2023-5542 GHSA-8mm2-m2gp-c6x2
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting vulnerability
PKSA-mc6m-hdgk-qpkp CVE-2023-5546 GHSA-9724-h8p7-r3jv
Affected version: <4.3.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to Cross-site Scripting
PKSA-1tyr-r2xr-8vx6 CVE-2023-35131 GHSA-fwfj-8p36-rc64
Affected version: <3.11.15|>=4.0.0,<4.0.9|>=4.1.0,<4.1.4|=4.2.0
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to SQL Injection
PKSA-dhd3-j88c-2sy9 CVE-2023-35132 GHSA-49mv-vfcp-8gg9
Affected version: <3.9.22|>=3.10.0,<3.11.15|>=4.0.0,<4.0.9|>=4.1.0,<4.1.4|=4.2.0
Reported by:
GitHub -
[HIGH] Moodle vulnerable to Server Side Request Forgery
PKSA-59yt-9rbk-gvyv CVE-2023-35133 GHSA-xxp4-mf4h-6cwm
Affected version: <3.9.22|>=3.10.0,<3.11.15|>=4.0.0,<4.0.9|>=4.1.0,<4.1.4|=4.2.0
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to stored Cross-site Scripting
PKSA-rn3d-zrrq-myhz CVE-2021-27131 GHSA-w2pm-fr62-jgv4
Affected version: <=3.10.1
Reported by:
GitHub -
[MEDIUM] Moodle External Control of File Name or Path vulnerability
PKSA-tkmd-sfy5-9ntm CVE-2023-30943 GHSA-22gj-8qj2-fj46
Affected version: <4.2.0-rc2
Reported by:
GitHub -
[HIGH] Moodle SQL Injection vulnerability
PKSA-vvyj-pzxn-byrt CVE-2023-30944 GHSA-7mmc-22g7-3xq2
Affected version: <4.2.0-rc2
Reported by:
GitHub -
[MEDIUM] Moodle may allow students to bypass sequential navigation during a quiz attempt
PKSA-s41w-d8tm-rcvv CVE-2022-40208 GHSA-948f-j464-rfj2
Affected version: <3.9.16|>=3.11.0,<3.11.9|>=4.0.0,<4.0.3
Reported by:
GitHub -
[MEDIUM] Moodle may display roles to users who don't have access to them
PKSA-mxtf-x1wg-7bp2 CVE-2023-1402 GHSA-vj5p-fp42-774p
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[HIGH] Moodle SQL Injection vulnerability
PKSA-rp95-37zp-mm24 CVE-2023-28329 GHSA-72w2-j52c-7682
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[MEDIUM] Moodle arbitrary file read vulnerability
PKSA-mc13-1wkx-jq4t CVE-2023-28330 GHSA-56r9-72vx-q989
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to Cross-site Scripting
PKSA-bxtb-x3pj-rjq1 CVE-2023-28331 GHSA-77jm-f3vj-xvx2
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional
PKSA-7jf2-xyg3-8k5b CVE-2023-28332 GHSA-9f45-9qrw-pp4v
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[CRITICAL] Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input
PKSA-55x8-drvs-2svz CVE-2023-28333 GHSA-q2x3-2f9g-h559
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[MEDIUM] Moodle may allow authenticated users to enumerate other user's names via learning plans page
PKSA-g5h3-zwb4-389q CVE-2023-28334 GHSA-hh52-g5c4-wprh
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[MEDIUM] Moodle may allow teachers to access the names of users they could not otherwise access
PKSA-fyrz-rtnj-32jm CVE-2023-28336 GHSA-prjm-2fj2-787f
Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2
Reported by:
GitHub -
[MEDIUM] Moodle has Incorrect Default Permissions
PKSA-p97s-2nyv-wn21 CVE-2021-36397 GHSA-2wmj-8mqg-r9q8
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting vulnerability
PKSA-dvwm-fjsh-f11d CVE-2021-36399 GHSA-79jp-m64f-pgrc
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[MEDIUM] Moodle has Incorrect Default Permissions
PKSA-d6ng-xnwt-yqc8 CVE-2021-36400 GHSA-35wf-3wq2-r3hx
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[MEDIUM] Moodle vulnerable to Stored Cross-site Scripting
PKSA-6thw-4qmq-h8nv CVE-2021-36401 GHSA-g6h6-4fp6-w33w
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[MEDIUM] Moodle Improper Input Validation vulnerability
PKSA-rsfn-3wg6-9b49 CVE-2021-36402 GHSA-gv8f-43pg-c5qw
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[MEDIUM] Moodle has a Hidden Functionality vulnerability
PKSA-9gf2-4rwz-pbz6 CVE-2021-36403 GHSA-j9cw-5cpj-9qj5
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[CRITICAL] Moodle SQL Injection vulnerability
PKSA-fvzz-7jy5-jqd2 CVE-2021-36392 GHSA-qc86-vgf2-6fq6
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[CRITICAL] Moodle SQL Injection vulnerability
PKSA-4hr3-sj2q-bthv CVE-2021-36393 GHSA-f46j-r7q3-6cm2
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[CRITICAL] Moodle Session Fixation vulnerability
PKSA-p137-z8ts-57qr CVE-2021-36394 GHSA-2563-fp9c-mgm8
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[HIGH] Moodle vulnerable to Uncontrolled Resource Consumption
PKSA-gr2v-z4dh-7y8z CVE-2021-36395 GHSA-273w-7fxj-pcp6
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[HIGH] Moodle vulnerable to Server-Side Request Forgery
PKSA-wqjn-7ff5-5vg5 CVE-2021-36396 GHSA-4rmj-w58m-fvch
Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting vulnerability
PKSA-j8km-3bqv-4yq3 CVE-2023-23921 GHSA-97qf-pq7x-964m
Affected version: >=4.1.0-beta,<4.1.1|>=4.0.0-beta,<4.0.6|>=3.10.0,<3.11.12|<3.9.19
Reported by:
GitHub -
[HIGH] Moodle Improper Access Control vulnerability
PKSA-9ggk-wqx1-s523 CVE-2023-23923 GHSA-32jc-9p58-p82x
Affected version: >=4.1.0-beta,<4.1.1|>=4.0.0-beta,<4.0.6|>=3.10.0,<3.11.12|<3.9.19
Reported by:
GitHub -
[CRITICAL] Moodle remote code execution
PKSA-gn18-mdrw-79m2 CVE-2022-40314 GHSA-2hmm-q272-xmhf
Affected version: >=4.0,<4.0.4|>=3.11,<3.11.10|<3.9.17
Reported by:
GitHub -
[MEDIUM] Moodle Cross-site Scripting vulnerability
PKSA-svbd-jdv9-tzjd CVE-2021-36568 GHSA-fm6m-fg23-67jq
Affected version: >=3.11.0,<3.11.10|>=3.10.0,<=3.10.4|<=3.9.7
Reported by:
GitHub -
[HIGH] Moodle Incorrect Authorization vulnerability
PKSA-pybv-gvgr-dkpg CVE-2020-14321 GHSA-9q29-jcjw-fw7h
Affected version: <3.5.13|>=3.6.0-beta,<3.7.7|>=3.8.0-beta,<3.8.4|>=3.9.0-beta,<3.9.1
Reported by:
GitHub -
[MEDIUM] Missing permission check in Moodle
PKSA-m6dd-wy5n-1jcz CVE-2021-20283 GHSA-2m72-m5cw-3g9h
Affected version: <3.5.17|>=3.8.0,<3.8.8|>=3.9.0,<3.9.5|>=3.10.0,<3.10.2
Reported by:
GitHub -
[MEDIUM] moodle Improper Access Control
PKSA-5myr-qbdk-7wg5 CVE-2019-10189 GHSA-h7xp-7fjp-ghhc
Affected version: <3.5.7|>=3.6.0,<3.6.5|>=3.7.0,<3.7.1
Reported by:
GitHub -
[MEDIUM] moodle Improper Access Control
PKSA-mrw7-dxd8-j1dz CVE-2019-10188 GHSA-92q5-2h76-vgmj
Affected version: >=3.7.0,<3.7.1|>=3.6.0,<3.6.5|<3.5.7
Reported by:
GitHub -
[MEDIUM] Moodle Open Redirect Vulnerability
PKSA-h548-xjzn-44z4 CVE-2019-10133 GHSA-5xp2-rv4h-mm2q
Affected version: <=3.1.17|>=3.4.0,<=3.4.8|>=3.5.0,<=3.5.5|>=3.6.0,<=3.6.3
Reported by:
GitHub -
[HIGH] Moodle Unrestricted file upload vulnerability
PKSA-kpgk-j8s9-6ynw CVE-2016-9187 GHSA-58fm-v4pr-jh8p
Affected version: >=2.0.1,<=3.2.1
Reported by:
GitHub -
[MEDIUM] Moodle XSS Vulnerability
PKSA-qzsz-dwgf-596p CVE-2016-9188 GHSA-7ghm-fp7p-qvjq
Affected version: >=2.0.1,<=3.2.1
Reported by:
GitHub -
[MEDIUM] Moodle Cross-Site Request Forgery (CSRF)
PKSA-rbhh-sssv-7prs CVE-2017-7491 GHSA-3hmr-948v-5qgq
Affected version: >=2.7,<2.7.20|>=3.0,<3.0.10|>=3.1,<3.1.6|>=3.2,<3.2.3
Reported by:
GitHub -
[CRITICAL] Moodle SQL injection via user preferences
PKSA-byjx-49pn-7gbn CVE-2017-2641 GHSA-xhq3-455r-xv44
Affected version: >=3.2,<3.2.2|>=3.1,<3.1.5|>=3.0,<3.0.9|>=2.7,<2.7.19
Reported by:
GitHub -
[MEDIUM] Moodle XSS Vulnerability
PKSA-3x5q-rssj-5cz4 CVE-2017-12156 GHSA-7mfw-g8x4-rq2w
Affected version: <=3.1.7|>=3.2.0,<=3.2.4|>=3.3.0,<=3.3.1
Reported by:
GitHub -
[MEDIUM] Moodle sensitive information disclosure
PKSA-c1md-j5p9-qkdj CVE-2017-12157 GHSA-gw95-48xq-gqf9
Affected version: <=3.1.7|>=3.2.0,<=3.2.4|>=3.3.0,<=3.3.1
Reported by:
GitHub -
[MEDIUM] Moodle Unauthorized searching of arbitrary blogs by typing full url
PKSA-c9dw-62wj-b876 CVE-2017-7490 GHSA-9x63-m3cc-qf3g
Affected version: >=2.7,<2.7.20|>=3.0,<3.0.10|>=3.1,<3.1.6|>=3.2,<3.2.3
Reported by:
GitHub -
[MEDIUM] Moodle Improper Privilege Management
PKSA-32mp-qz4y-gvx3 CVE-2017-7532 GHSA-jjhx-5jff-rc8m
Affected version: <3.1.7|>=3.2.0,<3.2.4|=3.3.0
Reported by:
GitHub -
[MEDIUM] Moodle External blog editing takeover
PKSA-qk32-gtbq-54wv CVE-2017-7489 GHSA-m34m-fgh4-v7cx
Affected version: >=2.7,<2.7.20|>=3.0,<3.0.10|>=3.1,<3.1.6|>=3.2,<3.2.3
Reported by:
GitHub -
[HIGH] Moodle XML import of ddwtos could lead to intentional remote code execution
PKSA-w7mj-pb7y-rhgn CVE-2018-14630 GHSA-c3pr-h96w-2jjg
Affected version: <3.1.14|>=3.2.0,<3.3.8|>=3.4.0,<3.4.5|>=3.5.0,<3.5.2
Reported by:
GitHub -
[MEDIUM] Moodle Stored HTML in assignment submission comments allowed links to be opened directly
PKSA-cjxh-89j3-yvhw CVE-2019-3850 GHSA-3fj7-9j8m-7r8g
Affected version: >=3.6.0,<3.6.3|>=3.5.0,<3.5.5|>=3.2.0,<3.4.8|<3.1.17
Reported by:
GitHub -
[HIGH] Moodle Users could elevate their role when accessing the LTI tool on a provider site
PKSA-tsyc-dk7h-qs9g CVE-2019-3849 GHSA-5wg9-5w3f-hxmh
Affected version: >=3.6,<3.6.3|>=3.5,<3.5.5|<3.4.8
Reported by:
GitHub -
[MEDIUM] Moodle XSS Vulnerability
PKSA-5wvg-81wj-qh1y CVE-2019-3808 GHSA-4r2p-wpv5-683w
Affected version: <=3.1.15|>=3.2.0,<=3.4.6|>=3.5.0,<=3.5.3|>=3.6.0,<=3.6.1
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to bypass intended access restrictions
PKSA-4qgs-3f9g-wc4z CVE-2015-5342 GHSA-6xpm-q8x9-j3rw
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11
Reported by:
GitHub -
[MEDIUM] Moodle sensitive information disclosure
PKSA-m9hq-ptn5-f797 CVE-2015-5340 GHSA-mmvj-j7hq-rx85
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|>=2.7.0,<2.7.11|<=2.6.11
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to read SCORM contents
PKSA-vrmn-wxwy-97gm CVE-2015-5341 GHSA-c2r4-f8qv-2v7v
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11
Reported by:
GitHub -
[MEDIUM] Moodle Information Disclosure
PKSA-5qj5-11vg-qvk1 CVE-2017-7531 GHSA-w2pj-r8m3-r4jc
Affected version: <3.3.1
Reported by:
GitHub -
[MEDIUM] Moodle XSS Vulnerability
PKSA-mtxw-jk4f-m72f CVE-2015-5337 GHSA-2hw6-6rgf-726v
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|>=2.7.0,<2.7.11|<=2.6.11
Reported by:
GitHub -
[HIGH] Moodle multiple cross-site request forgery (CSRF) vulnerabilities
PKSA-4bb7-mpff-vp25 CVE-2015-5338 GHSA-v33x-q8gh-4x42
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11
Reported by:
GitHub -
[MEDIUM] Moodle cross-site scripting (XSS) vulnerability
PKSA-jf6j-vc78-cp8m CVE-2015-3274 GHSA-f7qm-q26p-6rr2
Affected version: >=2.9.0,<2.9.1|>=2.8.0,<2.8.7|>=2.7.0,<2.7.9
Reported by:
GitHub -
[MEDIUM] Moodle multiple cross-site scripting (XSS) vulnerabilities
PKSA-579c-mvkm-rbfy CVE-2015-3275 GHSA-6922-5v25-p8jg
Affected version: >=2.9.0,<2.9.1|>=2.8.0,<2.8.7|>=2.7.0,<2.7.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to enter additional answer attempts
PKSA-vmm6-rqpt-pmdv CVE-2015-5264 GHSA-mm9q-3847-m48x
Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|>=2.7.0,<2.7.10
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to delete files
PKSA-4q4r-v281-1nqs CVE-2015-5265 GHSA-44xp-wj24-9xxj
Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|>=2.7.0,<2.7.10
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain manager privileges
PKSA-dv3x-18qf-fvt3 CVE-2015-5266 GHSA-454r-4cjv-vc9h
Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|>=2.7.0,<2.7.10
Reported by:
GitHub -
[HIGH] Moodle uses predictable password-recovery tokens
PKSA-hfyq-mgbf-xtb3 CVE-2015-5267 GHSA-382v-gxj9-ffhc
Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|<2.7.10
Reported by:
GitHub -
[MEDIUM] Moodle mishandles group-based authorization checks
PKSA-11kg-n1m6-bq4m CVE-2015-5268 GHSA-h34c-px28-rjgw
Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|<2.7.10
Reported by:
GitHub -
[MEDIUM] Moodle cross-site scripting (XSS) vulnerability
PKSA-zt3k-hnz4-xrj4 CVE-2015-5269 GHSA-5729-822w-j342
Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|<2.7.10
Reported by:
GitHub -
[MEDIUM] Moodle cross-site request forgery (CSRF) vulnerability
PKSA-6xg5-ptmj-4cn2 CVE-2015-5335 GHSA-hpmv-wvq3-gj27
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11
Reported by:
GitHub -
[MEDIUM] Moodle multiple cross-site scripting (XSS) vulnerabilities
PKSA-t3cj-1j63-ywv4 CVE-2015-5336 GHSA-grvw-qq2j-r898
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11
Reported by:
GitHub -
[MEDIUM] Moodle does not properly implement group-based access restrictions
PKSA-xv71-1ryj-tkpd CVE-2015-5339 GHSA-gmhr-6f43-7qpj
Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11
Reported by:
GitHub -
[MEDIUM] Moodle Arbitrary Redirect
PKSA-g4rm-6q21-2mmt CVE-2015-3175 GHSA-h798-h7ff-93xv
Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|>=2.6.0,<2.6.11|<=2.5.9
Reported by:
GitHub -
[LOW] Moodle cross-site scripting (XSS) vulnerability
PKSA-pgwx-wjzq-mggw CVE-2015-3178 GHSA-9fmw-m4qx-6cq8
Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain sensitive course-structure information
PKSA-6ks7-zmpy-ncf2 CVE-2015-3180 GHSA-688p-pgj4-77hh
Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to bypass file-management restrictions
PKSA-w8kq-dtdw-vgnt CVE-2015-3181 GHSA-622h-cjgg-5mx6
Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11
Reported by:
GitHub -
[HIGH] Moodle open redirect vulnerability
PKSA-3msp-43z8-4nw1 CVE-2015-3272 GHSA-2hw2-h3mf-c2j9
Affected version: >=2.9.0,<2.9.1|>=2.8.0,<2.8.7|>=2.7.0,<2.7.9
Reported by:
GitHub -
[MEDIUM] Moodle directory traversal vulnerability
PKSA-tp98-8z5s-kbj5 CVE-2015-1493 GHSA-gphj-63h8-r9vq
Affected version: >=2.8.0,<2.8.3|>=2.7.0,<2.7.5|<2.6.8
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information
PKSA-b2x7-jg5t-2g8h CVE-2015-2266 GHSA-35pr-gqm6-r366
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to extract archives to arbitrary directories
PKSA-r8s2-5mc3-pv6n CVE-2015-2267 GHSA-cm4r-58pj-h2ph
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to cause a denial of service
PKSA-q1yp-2nqz-b158 CVE-2015-2268 GHSA-36cm-vrqh-8p98
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9
Reported by:
GitHub -
[LOW] Moodle XSS Vulnerability
PKSA-h6c8-tnwx-2f51 CVE-2015-2269 GHSA-cp39-43xr-2wrp
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|>=2.6.0,<2.6.9|<=2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain sensitive course information
PKSA-hwvf-5rt9-z24g CVE-2015-2270 GHSA-fp4h-j22r-vwcv
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9
Reported by:
GitHub -
[MEDIUM] Moodle does not consider the moodle/tag:flag capability
PKSA-3qsz-9j6v-gm49 CVE-2015-2271 GHSA-v3wp-35g3-m9mm
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to bypass a forced-password-change requirement
PKSA-27xq-htgk-jm9f CVE-2015-2272 GHSA-5659-g9p4-354f
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9
Reported by:
GitHub -
[LOW] Moodle cross-site scripting (XSS) vulnerability
PKSA-yw8j-6drp-1cx1 CVE-2015-2273 GHSA-w77v-xpxr-c6pv
Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9
Reported by:
GitHub -
[LOW] Moodle does not set the RISK_XSS bit for graders
PKSA-kfnw-tfjj-6p3n CVE-2015-3174 GHSA-6r7x-6q98-qcqp
Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers obtain full-name information
PKSA-g64b-srdk-yh9x CVE-2015-3176 GHSA-fqrg-vmvj-jv3x
Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11
Reported by:
GitHub -
[LOW] Moodle allows attackers to bypass intended login restrictions
PKSA-tgxp-6v2t-d4cw CVE-2015-3179 GHSA-4ppg-2mx6-fqx9
Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to bypass a messaging-disabled setting
PKSA-4cdp-42wk-t4nw CVE-2015-0214 GHSA-4jm2-c9jr-6prf
Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7
Reported by:
GitHub -
[LOW] Moodle allows attackers to upload files containing JavaScript
PKSA-3xvj-zgx8-36by CVE-2014-7835 GHSA-vrf6-q7qj-69v5
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6
Reported by:
GitHub -
[MEDIUM] Moodle multiple cross-site request forgery (CSRF) vulnerabilities
PKSA-7dsw-mhqq-zggg CVE-2014-7836 GHSA-wpq5-q3mj-8f3r
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to remove wiki pages
PKSA-396c-wmdr-pxzq CVE-2014-7837 GHSA-p3hj-cfhm-7g6v
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[HIGH] Moodle Temporary Passwords are Brute Force-able
PKSA-77dp-vfrk-4h6v CVE-2014-7845 GHSA-9v64-447r-wch6
Affected version: >=2.5.0,<=2.5.8|>=2.6.0,<=2.6.5|>=2.7.0,<=2.7.2
Reported by:
GitHub -
[MEDIUM] Moodle does not consider the moodle/tag:edit capability before adding a tag
PKSA-7bkh-3548-1jd8 CVE-2014-7846 GHSA-468q-9cmp-76wc
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to cause a denial of service
PKSA-f2dm-ppx5-2c2g CVE-2014-7847 GHSA-6vjg-2q57-rgfw
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attacks to obtain sensitive information
PKSA-nfpm-wg1g-82w4 CVE-2014-7848 GHSA-47cw-whh9-j2fq
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6
Reported by:
GitHub -
[MEDIUM] Moodle does not provide charset information in HTTP headers
PKSA-4y8z-n5wc-bxmp CVE-2014-9059 GHSA-crcq-pw8h-9xwf
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to trigger the generation of arbitrary messages
PKSA-bc4j-ywmc-7mbd CVE-2014-9060 GHSA-c87j-9rrq-h3j8
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain sensitive information
PKSA-2zg9-h96f-fxr7 CVE-2015-0211 GHSA-frhc-9hwc-x7j3
Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7
Reported by:
GitHub -
[LOW] Moodle cross-site scripting (XSS) vulnerability
PKSA-rdgv-cwk4-rgt1 CVE-2015-0212 GHSA-jj3j-mhgc-g4m4
Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7
Reported by:
GitHub -
[MEDIUM] Moodle multiple cross-site request forgery (CSRF) vulnerabilities
PKSA-xy15-xyyj-xchk CVE-2015-0213 GHSA-hhq7-jf2p-hw9c
Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain sensitive calendar-event information
PKSA-gfjr-p6fw-dkfr CVE-2015-0215 GHSA-fr9m-pjmm-qx9f
Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to cause a denial of service
PKSA-3sjh-11nk-p5kd CVE-2015-0217 GHSA-p497-37fc-xvvc
Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7
Reported by:
GitHub -
[MEDIUM] Moodle cross-site request forgery (CSRF) vulnerability
PKSA-gwzp-t449-t8d2 CVE-2015-0218 GHSA-5jph-mvfm-r27p
Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7
Reported by:
GitHub -
[MEDIUM] Moodle allows discovery of an author's username
PKSA-8dtb-3dch-zn8d CVE-2014-3617 GHSA-p5j7-26wj-423j
Affected version: >=2.7.0,<2.7.2|>=2.6.0,<2.6.5|<2.5.8
Reported by:
GitHub -
[MEDIUM] Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module
PKSA-vd8d-53dy-hc1q CVE-2014-7838 GHSA-43r4-vm25-qm78
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle multiple cross-site scripting (XSS) vulnerabilities
PKSA-vx9k-57cm-s586 CVE-2014-3548 GHSA-f66h-6mj2-rwj2
Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11
Reported by:
GitHub -
[LOW] Moodle multiple cross-site scripting (XSS) vulnerabilities
PKSA-wwg7-w6tq-nps3 CVE-2014-3551 GHSA-m8f5-9wg8-2c3h
Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11
Reported by:
GitHub -
[MEDIUM] Moodle does not enforce the moodle/site:accessallgroups capability requirement
PKSA-6cfx-gy79-92vk CVE-2014-3553 GHSA-mg69-5q59-8jcg
Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|<2.5.7
Reported by:
GitHub -
[LOW] Moodle cross-site scripting (XSS) vulnerability
PKSA-7fq1-fs84-nyrr CVE-2014-7830 GHSA-j4mr-vc54-h5pc
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle exposes hidden grades to students
PKSA-ttcc-s4hr-k9z2 CVE-2014-7831 GHSA-59j6-8g7w-prf7
Affected version: >=2.7.0,<2.7.3
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to bypass the mod/lti:view capability requirement
PKSA-3wv9-m6zt-m558 CVE-2014-7832 GHSA-mphj-h2fc-62x3
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain sensitive information
PKSA-znjp-qs57-xp64 CVE-2014-7833 GHSA-jq7x-gm9r-v8m7
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9
Reported by:
GitHub -
[MEDIUM] Moodle does not verify group permissions
PKSA-pxf1-574p-2hpf CVE-2014-7834 GHSA-557f-2hv4-7jjm
Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6
Reported by:
GitHub -
[HIGH] Moodle vulnerable to PHP object injection attacks
PKSA-z489-s91j-4s71 CVE-2014-3541 GHSA-fccf-p8fx-vjj4
Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11
Reported by:
GitHub -
[LOW] Moodle cross-site scripting (XSS) vulnerability
PKSA-dw67-sq9s-wcs2 CVE-2014-3544 GHSA-c9jp-244j-vh78
Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain username and course information
PKSA-b4xz-k616-hh1h CVE-2014-3546 GHSA-4c5g-w3gf-rf4f
Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11
Reported by:
GitHub -
[MEDIUM] Moodle multiple cross-site scripting (XSS) vulnerabilities
PKSA-gcfp-m31z-27tz CVE-2014-3547 GHSA-hwjv-mc78-cccj
Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7
Reported by:
GitHub -
[MEDIUM] Moodle Does Not Escape Characters In Email Headers
PKSA-mrhz-65pt-bwv4 CVE-2016-5013 GHSA-2hh3-jmv8-5fmx
Affected version: >=3.1,<3.1.1|>=2.7,<=2.7.14|>=2.8,<=2.8.12|>=2.9,<=2.9.6|>=3.0,<=3.0.4
Reported by:
GitHub -
[HIGH] Moodle Weak Password Recovery Mechanism for Forgotten Password
PKSA-gypm-xnhz-46q4 CVE-2016-7038 GHSA-2phx-w35g-x9vm
Affected version: >=3.1,<3.1.2|>=3.0,<3.0.6|>=2.9,<2.9.8|>=2.7,<2.7.16
Reported by:
GitHub -
[MEDIUM] Moodle Unauthenticated Access
PKSA-kdm6-vbx8-tjtr CVE-2016-8642 GHSA-x32v-7qw8-cpq8
Affected version: >=2.7.0,<=2.7.16|>=2.8.0,<=2.8.12|>=2.9.0,<=2.9.8|>=3.0.0,<=3.0.6|>=3.1.0,<=3.1.2
Reported by:
GitHub -
[MEDIUM] Moodle Incorrect sanitation of attributes in forums
PKSA-6w9m-cpwz-kns6 CVE-2017-2576 GHSA-cjrf-xg77-chpw
Affected version: >=3.2,<3.2.1|>=3.1,<3.1.4|>=3.0,<3.0.8|>=2.7,<2.7.18
Reported by:
GitHub -
[MEDIUM] Moodle sensitive information disclosure
PKSA-t8kx-3svp-d147 CVE-2016-0724 GHSA-hjrj-7wcj-7j3c
Affected version: >=3.0.0,<3.0.2|>=2.9.0,<2.9.4|>=2.8.0,<2.8.10|>=2.7.0,<2.7.12|<=2.6.11
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to discover student e-mail addresses
PKSA-dkbx-w2rv-cdkf CVE-2016-2151 GHSA-r3fc-hx6q-g6cq
Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13
Reported by:
GitHub -
[MEDIUM] Moodle XSS from profile fields from external db
PKSA-75hy-ngqk-dth8 CVE-2016-2152 GHSA-6mxm-wpqv-675h
Affected version: >=3.0,<3.0.3|>=2.9,<2.9.5|>=2.8,<2.8.11|>=2.7,<2.7.13
Reported by:
GitHub -
[MEDIUM] Moodle Reflected XSS in mod_data advanced search
PKSA-dxky-ffts-9sn2 CVE-2016-2153 GHSA-mj85-3hqq-r6r9
Affected version: >=3.0,<3.0.3|>=2.9,<2.9.5|>=2.8,<2.8.11|>=2.7,<2.7.13
Reported by:
GitHub -
[MEDIUM] Moodle provides calendar-event data without considering whether an activity is hidden
PKSA-z4n4-rs2c-6k1v CVE-2016-2156 GHSA-h8vc-v44p-5r2q
Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13
Reported by:
GitHub -
[HIGH] Moodle cross-site request forgery (CSRF) vulnerability
PKSA-1938-5qz6-t3bd CVE-2016-2157 GHSA-f5pm-c4cw-563p
Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13
Reported by:
GitHub -
[MEDIUM] Moodle allows attackers to obtain sensitive category-detail information
PKSA-yf1q-wfmq-s1cf CVE-2016-2158 GHSA-m882-j7gq-v9p7
Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13
Reported by:
GitHub -
[MEDIUM] Moodle External function mod_assign_save_submission does not check due dates
PKSA-p6dy-jn3p-67k9 CVE-2016-2159 GHSA-cw72-69wq-f9f2
Affected version: >=3.0,<3.0.3|>=2.9,<2.9.5|>=2.8,<2.8.11|>=2.7,<2.7.13
Reported by:
GitHub -
[MEDIUM] Moodle sensitive information disclosure
PKSA-5jbs-pdwn-23gd CVE-2016-2190 GHSA-r9pc-g29w-f86j
Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|>=2.7.0,<2.7.13|<=2.6.11
Reported by:
GitHub -
[MEDIUM] Moodle Improper Access Control
PKSA-3z86-fk6c-ct2p CVE-2016-3729 GHSA-g96h-wvrm-c2ww
Affected version: >=2.7,<2.7.14|>=2.8,<2.8.12|>=2.9,<2.9.6|>=3.0,<3.0.3
Reported by:
GitHub -
[MEDIUM] Moodle sensitive information disclosure
PKSA-3vth-zrsr-xtzw CVE-2016-3732 GHSA-5282-96ff-xx3h
Affected version: >=2.7.0,<=2.7.13|>=2.8.0,<=2.8.11|>=2.9.0,<=2.9.5|>=3.0.0,<=3.0.3
Reported by:
GitHub -
[MEDIUM] Moodle Improper Access Control
PKSA-fjjn-ck2v-kb6z CVE-2016-3733 GHSA-gr8j-qm8r-rfgg
Affected version: >=3.0,<3.0.4|>=2.9,<2.9.6|>=2.8,<2.8.12|>=2.7,<2.7.14
Reported by:
GitHub -
[HIGH] Moodle Cross-site request forgery (CSRF) vulnerability
PKSA-6zhw-kkgc-pssc CVE-2016-3734 GHSA-r867-v437-4rrm
Affected version: >=3.0,<3.0.4|>=2.9,<2.9.6|>=2.8,<2.8.12|<2.7.14
Reported by:
GitHub -
[MEDIUM] Moodle XSS Vulnerability
PKSA-yj7v-phmm-zs3f CVE-2019-3847 GHSA-qrcj-6fjw-3h9h
Affected version: <3.1.17|>=3.2.0,<3.4.8|>=3.5.0,<3.5.5|>=3.6.0,<3.6.3
Reported by:
GitHub -
[MEDIUM] Missing authorization in Moodle
PKSA-wnz7-3jhx-ydz3 CVE-2022-0984 GHSA-c5hf-mc85-2hx4
Affected version: <3.9.13|>=3.10.0,<3.10.10|>=3.11.0,<3.11.6
Reported by:
GitHub -
[HIGH] SQL Injection in Moodle
PKSA-3tp5-6sqk-x25n CVE-2022-0983 GHSA-h2fw-93qx-vrcq
Affected version: <3.9.13|>=3.10.0,<3.10.10|>=3.11.0,<3.11.6
Reported by:
GitHub -
[MEDIUM] Insufficient user authorization in Moodle
PKSA-bnvf-vkcb-sdkk CVE-2022-0334 GHSA-93pj-4p65-qmr9
Affected version: <3.9.11|>=3.10,<3.10.8|>=3.11,<3.11.5
Reported by:
GitHub -
[MEDIUM] Cross-Site Request Forgery in Moodle
PKSA-h8xw-wmt7-hqxg CVE-2020-1692 GHSA-9328-7pcw-vw69
Affected version: <3.7.2
Reported by:
GitHub