Moodle Moodle
629 CVEs affecting Moodle Moodle. Latest disclosed: 2026-05-10. Critical: 16, High: 81.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33999 | Critical | 9.8 | 2024-05-31 | The referrer URL used by MFA required additional sanitizing, rather than being used directly. |
CVE-2023-28333 | Critical | 9.8 | 2023-03-23 | The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anyw… |
CVE-2021-36394 | Critical | 9.8 | 2023-03-06 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
CVE-2021-36393 | Critical | 9.8 | 2023-03-06 | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. |
CVE-2021-36392 | Critical | 9.8 | 2023-03-06 | In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. |
CVE-2022-40315 | Critical | 9.8 | 2022-09-30 | A limited SQL injection risk was identified in the "browse list of users" site administration page. |
CVE-2022-40314 | Critical | 9.8 | 2022-09-30 | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. |
CVE-2022-35649 | Critical | 9.8 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote… |
CVE-2022-30600 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. |
CVE-2022-30599 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. |
CVE-2022-0332 | Critical | 9.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attem… |
CVE-2021-3943 | Critical | 9.8 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restor… |
CVE-2017-2641 | Critical | 9.8 | 2017-03-26 | In Moodle 2.x and 3.x, SQL injection can occur via user preferences. |
CVE-2022-45152 | Critical | 9.1 | 2022-11-25 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI pro… |
CVE-2021-21809 | Critical | 9.1 | 2021-06-23 | A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to comm… |
CVE-2019-14880 | Critical | 9.1 | 2020-03-31 | A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email… |
CVE-2025-67847 | High | 8.8 | 2026-01-23 | A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient… |
CVE-2025-3642 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers a… |
CVE-2025-3641 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers a… |
CVE-2025-3638 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSR… |