Moodle Project Moodle
9 CVEs affecting Moodle Project Moodle. Latest disclosed: 2025-02-24. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26525 | High | 8.6 | 2025-02-24 | Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live in… |
CVE-2025-26530 | High | 8.3 | 2025-02-24 | The question bank filter required additional sanitizing to prevent a reflected XSS risk. |
CVE-2025-26529 | High | 8.3 | 2025-02-24 | Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. |
CVE-2025-26533 | High | 8.1 | 2025-02-24 | An SQL injection risk was identified in the module list filter within course search. |
CVE-2025-26526 | Medium | 6.5 | 2025-02-24 | Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. |
CVE-2025-26527 | Medium | 5.3 | 2025-02-24 | Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. |
CVE-2025-26528 | Low | 3.4 | 2025-02-24 | The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. |
CVE-2025-26532 | Low | 3.1 | 2025-02-24 | Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. |
CVE-2025-26531 | Low | 3.1 | 2025-02-24 | Insufficient capability checks made it possible to disable badges a user does not have permission to access. |