CVE-2022-50943 | Medium | 6.1 | 2026-05-10 | Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through t… |
CVE-2026-26047 | Medium | 6.5 | 2026-02-21 | A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits c… |
CVE-2026-26046 | High | 7.2 | 2026-02-21 | A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. O… |
CVE-2026-26045 | High | 7.2 | 2026-02-21 | A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicio… |
CVE-2025-67857 | Medium | 4.3 | 2026-02-03 | A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorize… |
CVE-2025-67856 | Medium | 5.4 | 2026-02-03 | A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be gra… |
CVE-2025-67855 | Medium | 5.4 | 2026-02-03 | A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerabi… |
CVE-2025-67853 | High | 7.5 | 2026-02-03 | A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attacke… |
CVE-2025-67852 | Low | 3.5 | 2026-02-03 | A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages afte… |
CVE-2025-67851 | Medium | 6.1 | 2026-02-03 | A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit… |
CVE-2025-67850 | High | 7.3 | 2026-02-03 | A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula edi… |
CVE-2025-67849 | High | 7.3 | 2026-02-03 | A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject m… |
CVE-2025-67848 | High | 8.1 | 2026-02-03 | A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) P… |
CVE-2025-67847 | High | 8.8 | 2026-01-23 | A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient… |
CVE-2021-47857 | High | 7.2 | 2026-01-21 | Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts… |
CVE-2025-62401 | Medium | 5.4 | 2025-10-23 | An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an as… |
CVE-2025-62400 | Medium | 4.3 | 2025-10-23 | Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or res… |
CVE-2025-62399 | High | 7.5 | 2025-10-23 | Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attac… |
CVE-2025-62398 | Medium | 5.4 | 2025-10-23 | A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising… |
CVE-2025-62397 | Medium | 5.3 | 2025-10-23 | The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance. |
CVE-2025-62396 | Medium | 5.3 | 2025-10-23 | An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not pro… |
CVE-2025-62395 | Medium | 4.3 | 2025-10-23 | A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restri… |
CVE-2025-62394 | Medium | 4.3 | 2025-10-23 | Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related message… |
CVE-2025-62393 | Medium | 4.3 | 2025-10-23 | A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view info… |
CVE-2025-53021 | Medium | 4.2 | 2025-06-24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey… |
CVE-2025-34032 | Medium | 6.1 | 2025-06-24 | A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The applic… |
CVE-2025-34031 | High | 7.5 | 2025-06-24 | A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user… |
CVE-2025-3647 | Medium | 4.3 | 2025-04-25 | A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. |
CVE-2025-3645 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. |
CVE-2025-3644 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. |
CVE-2025-3643 | Medium | 5.4 | 2025-04-25 | A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk. |
CVE-2025-3642 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers a… |
CVE-2025-3641 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers a… |
CVE-2025-3640 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and p… |
CVE-2025-3638 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSR… |
CVE-2025-3637 | Low | 3.1 | 2025-04-25 | A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through… |
CVE-2025-3636 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks. |
CVE-2025-3635 | Low | 3.5 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against… |
CVE-2025-3628 | Medium | 4.3 | 2025-04-25 | A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. |
CVE-2025-3627 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying thei… |
CVE-2025-3625 | High | 7.1 | 2025-04-25 | A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging i… |
CVE-2025-32045 | Medium | 5.3 | 2025-04-25 | A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hi… |
CVE-2025-32044 | High | 7.5 | 2025-04-25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, an… |
CVE-2025-3634 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Spec… |
CVE-2025-26533 | High | 8.1 | 2025-02-24 | An SQL injection risk was identified in the module list filter within course search. |
CVE-2025-26532 | Low | 3.1 | 2025-02-24 | Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. |
CVE-2025-26531 | Low | 3.1 | 2025-02-24 | Insufficient capability checks made it possible to disable badges a user does not have permission to access. |
CVE-2025-26530 | High | 8.3 | 2025-02-24 | The question bank filter required additional sanitizing to prevent a reflected XSS risk. |
CVE-2025-26529 | High | 8.3 | 2025-02-24 | Description information displayed in the site administration live log
required additional sanitizing to prevent a stored XSS risk. |
CVE-2025-26528 | Low | 3.4 | 2025-02-24 | The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. |
CVE-2025-26527 | Medium | 5.3 | 2025-02-24 | Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. |
CVE-2025-26526 | Medium | 6.5 | 2025-02-24 | Separate Groups mode restrictions were not factored into permission
checks before allowing viewing or deletion of responses in Feedback
activities. |
CVE-2025-26525 | High | 8.6 | 2025-02-24 | Insufficient sanitizing in the TeX notation filter resulted in an
arbitrary file read risk on sites where pdfTeX is available (such as
those with TeX Live in… |
CVE-2024-48899 | Medium | 4.3 | 2024-11-20 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended… |
CVE-2024-45691 | Medium | 5.4 | 2024-11-20 | A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose com… |
CVE-2024-45690 | High | 7.5 | 2024-11-20 | A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts. |
CVE-2024-45689 | Medium | 6.5 | 2024-11-20 | A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not h… |
CVE-2024-48901 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit th… |
CVE-2024-48898 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permiss… |
CVE-2024-48897 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify. |
CVE-2024-48896 | Medium | 4.3 | 2024-11-18 | A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have ac… |
CVE-2024-48900 | Medium | 4.3 | 2024-11-13 | A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those the… |
CVE-2024-43439 | Medium | 5.4 | 2024-11-11 | A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk. |
CVE-2024-43437 | Medium | 5.4 | 2024-11-11 | A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup f… |
CVE-2024-43435 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the glo… |
CVE-2024-43433 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users. |
CVE-2024-43432 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request header… |
CVE-2024-43430 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. External API access to Quiz can override contained insufficient access control. |
CVE-2024-43429 | Medium | 5.3 | 2024-11-11 | A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields"… |
CVE-2024-43427 | Low | 3.7 | 2024-11-11 | A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, whi… |
CVE-2024-43440 | High | 7.5 | 2024-11-07 | A flaw was found in moodle. A local file may include risks when restoring block backups. |
CVE-2024-43438 | High | 7.5 | 2024-11-07 | A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned… |
CVE-2024-43436 | High | 7.2 | 2024-11-07 | A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. |
CVE-2024-43434 | High | 8.1 | 2024-11-07 | The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability. |
CVE-2024-43431 | High | 7.5 | 2024-11-07 | A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access. |
CVE-2024-43428 | High | 7.7 | 2024-11-07 | To address a cache poisoning risk in Moodle, additional validation for local storage was required. |
CVE-2024-43426 | High | 7.5 | 2024-11-07 | A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such… |
CVE-2024-43425 | High | 8.1 | 2024-11-07 | A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the ca… |
CVE-2024-34312 | Medium | 6.1 | 2024-06-24 | Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js. |
CVE-2024-37674 | Medium | 5.5 | 2024-06-20 | Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity. |
CVE-2024-38277 | Medium | 5.4 | 2024-06-18 | A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. |
CVE-2024-38276 | High | 8.8 | 2024-06-18 | Incorrect CSRF token checks resulted in multiple CSRF risks. |
CVE-2024-38275 | High | 7.5 | 2024-06-18 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally se… |
CVE-2024-38274 | Medium | 6.1 | 2024-06-18 | Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. |
CVE-2024-38273 | Medium | 5.4 | 2024-06-18 | Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. |
CVE-2024-34009 | High | 7.5 | 2024-05-31 | Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is u… |
CVE-2024-34008 | High | 8.8 | 2024-05-31 | Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk. |
CVE-2024-34007 | High | 8.8 | 2024-05-31 | The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF. |
CVE-2024-34006 | Medium | 4.3 | 2024-05-31 | The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered. |
CVE-2024-34005 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activit… |
CVE-2024-34004 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and… |
CVE-2024-34003 | Medium | 5.9 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules… |
CVE-2024-34002 | Medium | 6.5 | 2024-05-31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules… |
CVE-2024-34001 | High | 8.4 | 2024-05-31 | Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. |
CVE-2024-34000 | Medium | 4.3 | 2024-05-31 | ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. |
CVE-2024-33999 | Critical | 9.8 | 2024-05-31 | The referrer URL used by MFA required additional sanitizing, rather than being used directly. |
CVE-2024-33998 | Medium | 5.4 | 2024-05-31 | Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. |
CVE-2024-33997 | Medium | 6.1 | 2024-05-31 | Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation. |
CVE-2024-33996 | Medium | 6.2 | 2024-05-31 | Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have p… |
CVE-2024-28593 | Medium | 5.4 | 2024-03-22 | The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance d… |