Moodle
Page 4 of 7 — Moodle CVEs from a corpus of 633, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2645 | Medium | 6.1 | 2017-03-26 | In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. |
CVE-2017-2644 | Medium | 6.1 | 2017-03-26 | In Moodle 3.x, XSS can occur via evidence of prior learning. |
CVE-2017-2643 | Medium | 5.3 | 2017-03-26 | In Moodle 3.2.x, global search displays user names for unauthenticated users. |
CVE-2017-2641 | Critical | 9.8 | 2017-03-26 | In Moodle 2.x and 3.x, SQL injection can occur via user preferences. |
CVE-2017-2578 | Medium | 6.1 | 2017-01-20 | In Moodle 3.x, there is XSS in the assignment submission page. |
CVE-2017-2576 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. |
CVE-2016-8644 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. |
CVE-2016-8643 | Medium | 4.3 | 2017-01-20 | In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. |
CVE-2016-8642 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. |
CVE-2016-7038 | High | 7.3 | 2017-01-20 | In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. |
CVE-2016-5014 | Medium | 5.4 | 2017-01-20 | In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course. |
CVE-2016-5013 | Medium | 5.4 | 2017-01-20 | In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. |
CVE-2016-5012 | Medium | 5.3 | 2017-01-20 | In Moodle 3.x, glossary search displays entries without checking user permissions to view them. |
CVE-2016-9188 | Medium | 6.1 | 2016-11-04 | Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalh… |
CVE-2016-9187 | High | 8.8 | 2016-11-04 | Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbit… |
CVE-2016-9186 | High | 8.8 | 2016-11-04 | Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arb… |
CVE-2016-7919 | High | 7.5 | 2016-10-28 | Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration p… |
CVE-2016-2190 | Medium | 5.3 | 2016-05-22 | Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remo… |
CVE-2016-2159 | Medium | 4.3 | 2016-05-22 | The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x be… |
CVE-2016-2158 | Medium | 4.3 | 2016-05-22 | lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin f… |
CVE-2016-2157 | High | 8.8 | 2016-05-22 | Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x… |
CVE-2016-2156 | Medium | 4.3 | 2016-05-22 | calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event… |
CVE-2016-2155 | Medium | 4.3 | 2016-05-22 | The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moo… |
CVE-2016-2154 | Medium | 4.3 | 2016-05-22 | admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewh… |
CVE-2016-2153 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x b… |
CVE-2016-2152 | Medium | 6.1 | 2016-05-22 | Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5… |
CVE-2016-2151 | Medium | 4.3 | 2016-05-22 | user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on… |
CVE-2016-0725 | Medium | 6.1 | 2016-02-22 | Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x befor… |
CVE-2016-0724 | Medium | 4.3 | 2016-02-22 | The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2… |
CVE-2015-5342 | Medium | 4.3 | 2016-02-22 | The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intende… |
CVE-2015-5341 | Medium | 4.3 | 2016-02-22 | mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenti… |
CVE-2015-5340 | Medium | 4.3 | 2016-02-22 | Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows… |
CVE-2015-5339 | Medium | 4.3 | 2016-02-22 | The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9… |
CVE-2015-5338 | High | 8.8 | 2016-02-22 | Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x be… |
CVE-2015-5337 | Medium | 6.1 | 2016-02-22 | Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows… |
CVE-2015-5336 | Medium | 5.4 | 2016-02-22 | Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2… |
CVE-2015-5335 | Medium | 4.3 | 2016-02-22 | Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x… |
CVE-2015-5332 | Medium | 6.8 | 2016-02-22 | Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role a… |
CVE-2015-5331 | Medium | 4.3 | 2016-02-22 | Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass i… |
CVE-2015-5272 | Medium | 4.3 | 2016-02-22 | The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by… |
CVE-2015-5269 | Medium | 5.4 | 2016-02-22 | Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows… |
CVE-2015-5268 | Medium | 4.3 | 2016-02-22 | The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, whi… |
CVE-2015-5267 | High | 7.5 | 2016-02-22 | lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the… |
CVE-2015-5266 | Medium | 6.8 | 2016-02-22 | The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote… |
CVE-2015-5265 | Medium | 4.3 | 2016-02-22 | The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capabil… |
CVE-2015-5264 | Medium | 5.4 | 2016-02-22 | The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intende… |
CVE-2015-3275 | Medium | 6.1 | 2016-02-22 | Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9… |
CVE-2015-3274 | Medium | 6.1 | 2016-02-22 | Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7… |
CVE-2015-3273 | Medium | 4.3 | 2016-02-22 | mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" act… |
CVE-2015-3272 | High | 7.4 | 2016-02-22 | Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before… |
CVE-2015-3181 | | 2015-06-01 | files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles… | |
CVE-2015-3180 | | 2015-06-01 | lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sens… | |
CVE-2015-3179 | | 2015-06-01 | login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended… | |
CVE-2015-3178 | | 2015-06-01 | Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before… | |
CVE-2015-3177 | | 2015-06-01 | Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows… | |
CVE-2015-3176 | | 2015-06-01 | The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote at… | |
CVE-2015-3175 | | 2015-06-01 | Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redir… | |
CVE-2015-3174 | | 2015-06-01 | mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, whic… | |
CVE-2015-2273 | | 2015-06-01 | Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before… | |
CVE-2015-2272 | | 2015-06-01 | login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-pa… | |
CVE-2015-2271 | | 2015-06-01 | tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before pr… | |
CVE-2015-2270 | | 2015-06-01 | lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, esta… | |
CVE-2015-2269 | | 2015-06-01 | Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x befo… | |
CVE-2015-2268 | | 2015-06-01 | filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause… | |
CVE-2015-2267 | | 2015-06-01 | mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access… | |
CVE-2015-2266 | | 2015-06-01 | message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages cap… | |
CVE-2015-1493 | | 2015-06-01 | Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7… | |
CVE-2015-0218 | | 2015-06-01 | Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before… | |
CVE-2015-0217 | | 2015-06-01 | filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to caus… | |
CVE-2015-0216 | | 2015-06-01 | access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cros… | |
CVE-2015-0215 | | 2015-06-01 | calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain se… | |
CVE-2015-0214 | | 2015-06-01 | message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a m… | |
CVE-2015-0213 | | 2015-06-01 | Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9… | |
CVE-2015-0212 | | 2015-06-01 | Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows r… | |
CVE-2015-0211 | | 2015-06-01 | mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities a… | |
CVE-2014-9060 | | 2014-11-24 | The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a ret… | |
CVE-2014-9059 | | 2014-11-24 | lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, wh… | |
CVE-2014-7848 | | 2014-11-24 | lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, whi… | |
CVE-2014-7847 | | 2014-11-24 | iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of servic… | |
CVE-2014-7846 | | 2014-11-24 | tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capabil… | |
CVE-2014-7845 | | 2014-11-24 | The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of… | |
CVE-2014-7838 | | 2014-11-24 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x befo… | |
CVE-2014-7837 | | 2014-11-24 | mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pa… | |
CVE-2014-7836 | | 2014-11-24 | Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before… | |
CVE-2014-7835 | | 2014-11-24 | webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remot… | |
CVE-2014-7834 | | 2014-11-24 | mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to acc… | |
CVE-2014-7833 | | 2014-11-24 | mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entr… | |
CVE-2014-7832 | | 2014-11-24 | mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the co… | |
CVE-2014-7831 | | 2014-11-24 | lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which al… | |
CVE-2014-7830 | | 2014-11-24 | Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6… | |
CVE-2014-3617 | | 2014-09-15 | The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allow… | |
CVE-2014-3553 | | 2014-07-29 | mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce… | |
CVE-2014-3552 | | 2014-07-29 | The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether… | |
CVE-2014-3551 | | 2014-07-29 | Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2… | |
CVE-2014-3550 | | 2014-07-29 | Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitra… | |
CVE-2014-3549 | | 2014-07-29 | Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote… | |
CVE-2014-3548 | | 2014-07-29 | Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7… | |
CVE-2014-3547 | | 2014-07-29 | Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remot… | |
CVE-2014-3546 | | 2014-07-29 | Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in… | |
CVE-2014-3545 | | 2014-07-29 | Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitra… |