Moodle Project 9 CVEs across 1 Moodle Project products. Browse Moodle Project vulnerabilities, severities, and proof-of-concept exploits.
Moodle Project products with known CVEs Moodle Project CVEs — newest first CVE Severity Score Published Summary CVE-2025-26533High 8.12025-02-24 An SQL injection risk was identified in the module list filter within course search. CVE-2025-26532Low 3.12025-02-24 Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. CVE-2025-26531Low 3.12025-02-24 Insufficient capability checks made it possible to disable badges a user does not have permission to access. CVE-2025-26530High 8.32025-02-24 The question bank filter required additional sanitizing to prevent a reflected XSS risk. CVE-2025-26529High 8.32025-02-24 Description information displayed in the site administration live log
required additional sanitizing to prevent a stored XSS risk. CVE-2025-26528Low 3.42025-02-24 The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. CVE-2025-26527Medium 5.32025-02-24 Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. CVE-2025-26526Medium 6.52025-02-24 Separate Groups mode restrictions were not factored into permission
checks before allowing viewing or deletion of responses in Feedback
activities. CVE-2025-26525High 8.62025-02-24 Insufficient sanitizing in the TeX notation filter resulted in an
arbitrary file read risk on sites where pdfTeX is available (such as
those with TeX Live in…