Moodle
Page 3 of 7 — Moodle CVEs from a corpus of 633, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43560 | Medium | 5.3 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it p… |
CVE-2021-43559 | High | 8.8 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality… |
CVE-2021-43558 | Medium | 6.1 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site adm… |
CVE-2021-3943 | Critical | 9.8 | 2021-11-22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restor… |
CVE-2021-21809 | Critical | 9.1 | 2021-06-23 | A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to comm… |
CVE-2021-32244 | Medium | 5.4 | 2021-06-16 | Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field. |
CVE-2019-14827 | Medium | 6.1 | 2021-05-17 | A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper t… |
CVE-2019-14831 | Medium | 6.1 | 2021-03-19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open red… |
CVE-2019-14830 | Medium | 6.1 | 2021-03-19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an op… |
CVE-2019-14829 | Medium | 4.3 | 2021-03-19 | A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities we… |
CVE-2019-14828 | Medium | 4.3 | 2021-03-19 | A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to cre… |
CVE-2021-20283 | Medium | 4.3 | 2021-03-15 | The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in eac… |
CVE-2021-20282 | Medium | 5.3 | 2021-03-15 | When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5… |
CVE-2021-20281 | Medium | 5.3 | 2021-03-15 | It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3… |
CVE-2021-20280 | Medium | 5.4 | 2021-03-15 | Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. |
CVE-2021-20279 | Medium | 5.4 | 2021-03-15 | The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. |
CVE-2021-20185 | Medium | 5.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result… |
CVE-2021-20187 | High | 7.2 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP i… |
CVE-2021-20186 | Medium | 5.4 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was req… |
CVE-2021-20184 | Medium | 4.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able… |
CVE-2021-20183 | Medium | 5.4 | 2021-01-28 | It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries. |
CVE-2020-25627 | Medium | 6.1 | 2020-12-09 | The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2. |
CVE-2020-25631 | Medium | 6.1 | 2020-12-08 | A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which wa… |
CVE-2020-25630 | High | 7.5 | 2020-12-08 | A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could le… |
CVE-2020-25629 | High | 8.8 | 2020-12-08 | A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site admin… |
CVE-2020-25628 | Medium | 6.1 | 2020-12-08 | The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 a… |
CVE-2020-25703 | Medium | 5.3 | 2020-11-19 | The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 t… |
CVE-2020-25702 | Medium | 6.1 | 2020-11-19 | In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10. |
CVE-2020-25701 | Medium | 5.3 | 2020-11-19 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable t… |
CVE-2020-25700 | Medium | 6.5 | 2020-11-19 | In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8… |
CVE-2020-25699 | High | 7.5 | 2020-11-19 | In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Ve… |
CVE-2020-25698 | High | 7.5 | 2020-11-19 | Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrollin… |
CVE-2020-10738 | High | 7.5 | 2020-05-21 | A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible… |
CVE-2019-14880 | Critical | 9.1 | 2020-03-31 | A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email… |
CVE-2019-14884 | Medium | 6.1 | 2020-03-18 | A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages. |
CVE-2019-14883 | Medium | 5.3 | 2020-03-18 | A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disable… |
CVE-2019-14882 | Medium | 6.1 | 2020-03-18 | A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page. |
CVE-2019-14881 | Medium | 6.1 | 2020-03-18 | A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed. |
CVE-2020-1692 | High | 8.1 | 2020-02-17 | Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course. |
CVE-2019-18210 | Medium | 5.4 | 2020-02-11 | Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another u… |
CVE-2019-14879 | Medium | 5.4 | 2020-01-07 | A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the asso… |
CVE-2012-1170 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough |
CVE-2012-1169 | Medium | 5.3 | 2019-11-14 | Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page… |
CVE-2012-1161 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results |
CVE-2012-1160 | Low | 2.7 | 2019-11-14 | Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php |
CVE-2012-1159 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2: Overview report allows users to see hidden courses |
CVE-2012-1158 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export |
CVE-2012-1157 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default |
CVE-2012-1168 | High | 8.2 | 2019-11-14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified. |
CVE-2012-1156 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has users' private files included in course backups |
CVE-2012-1155 | High | 7.5 | 2019-11-14 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the… |
CVE-2019-10189 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assig… |
CVE-2019-10188 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. |
CVE-2019-10187 | Medium | 4.3 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other… |
CVE-2019-10186 | High | 8.8 | 2019-07-31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool. |
CVE-2019-10154 | High | 7.5 | 2019-06-26 | A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations. |
CVE-2019-10134 | Low | 3.7 | 2019-06-26 | A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their q… |
CVE-2019-10133 | Low | 3.1 | 2019-06-26 | A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to inter… |
CVE-2019-3847 | Medium | 4.8 | 2019-03-27 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/ma… |
CVE-2019-3852 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing i… |
CVE-2019-3851 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students… |
CVE-2019-3850 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the sam… |
CVE-2019-3849 | High | 8.8 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed… |
CVE-2019-3848 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the ca… |
CVE-2019-3810 | Medium | 6.1 | 2019-03-25 | A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape… |
CVE-2019-3809 | Medium | 6.5 | 2019-03-25 | A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it sho… |
CVE-2019-3808 | Medium | 5.4 | 2019-03-25 | A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability di… |
CVE-2019-6970 | High | 7.5 | 2019-03-21 | Moodle 3.5.x before 3.5.4 allows SSRF. |
CVE-2018-16854 | Medium | 6.5 | 2018-11-26 | A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent… |
CVE-2018-14631 | High | 8.8 | 2018-09-17 | moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provid… |
CVE-2018-14630 | High | 8.8 | 2018-09-17 | moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing leg… |
CVE-2018-10891 | High | 7.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is… |
CVE-2018-10890 | Medium | 4.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categor… |
CVE-2018-10889 | Medium | 4.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other us… |
CVE-2018-1137 | High | 8.1 | 2018-05-25 | An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged… |
CVE-2018-1136 | Medium | 4.3 | 2018-05-25 | An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a securi… |
CVE-2018-1135 | Medium | 6.5 | 2018-05-25 | An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the d… |
CVE-2018-1134 | Medium | 6.5 | 2018-05-25 | An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the d… |
CVE-2018-1133 | High | 8.8 | 2018-05-25 | An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection. |
CVE-2018-1082 | High | 8.1 | 2018-04-04 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the use… |
CVE-2018-1081 | Medium | 5.3 | 2018-04-04 | A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom m… |
CVE-2018-1045 | Medium | 5.4 | 2018-01-22 | In Moodle 3.x, there is XSS via a calendar event name. |
CVE-2018-1044 | Medium | 4.3 | 2018-01-22 | In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings. |
CVE-2018-1043 | Medium | 6.5 | 2018-01-22 | In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames. |
CVE-2018-1042 | Medium | 6.5 | 2018-01-22 | Moodle 3.x has Server Side Request Forgery in the filepicker. |
CVE-2017-15110 | Medium | 4.3 | 2017-11-20 | In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email a… |
CVE-2017-12157 | Medium | 4.3 | 2017-09-18 | In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
CVE-2017-12156 | Medium | 6.1 | 2017-09-18 | Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
CVE-2017-7532 | Medium | 6.5 | 2017-07-17 | In Moodle 3.x, course creators are able to change system default settings for courses. |
CVE-2017-7531 | Medium | 4.3 | 2017-07-17 | In Moodle 3.3, the course overview block reveals activities in hidden courses. |
CVE-2017-2642 | Medium | 6.5 | 2017-07-17 | Moodle 3.x has user fullname disclosure on the user preferences page. |
CVE-2017-7491 | Medium | 4.3 | 2017-05-15 | In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration s… |
CVE-2017-7490 | Medium | 5.3 | 2017-05-15 | In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. |
CVE-2017-7489 | Medium | 6.3 | 2017-05-15 | In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. |
CVE-2016-3734 | High | 8.8 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and ear… |
CVE-2016-3733 | Medium | 4.3 | 2017-04-20 | The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated u… |
CVE-2016-3732 | Medium | 4.3 | 2017-04-20 | The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote a… |
CVE-2016-3731 | Medium | 5.3 | 2017-04-20 | Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions. |
CVE-2016-3729 | Medium | 6.5 | 2017-04-20 | The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to… |
CVE-2017-7298 | Medium | 5.4 | 2017-03-29 | In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. |