CVEs (637)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Authenticated users were able to enumerate other users' names via the learning plans page. |
2Fedoraproject Moodle2Fedora MoodleJun 17, 2026 Mar 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS). |
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. |
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. |
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default. |
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers). |
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. |
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. |
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. |
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. |
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. |
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. |
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. |
In Moodle, insufficient capability checks meant message deletions were not limited to the current user. |
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. |
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. |
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. |
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to ga...Show more |