Moodle
moodle
639 CVEs • 3 products
Products (3)
Click to collapseToggle
Products (3)
Click to collapse
CVEs (639)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroo...Show more |
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle we...Show more |
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle we...Show more |
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. |
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. |
The referrer URL used by MFA required additional sanitizing, rather than being used directly. |
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. |
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation. |
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to. |
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you k...Show more |
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter. |
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page). |
The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. |
Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers. |
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers. |
The URL parameters accepted by forum search were not limited to the allowed parameters. |
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality. |
Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to...Show more |
2Fedoraproject Moodle3Extra Packages For Enterprise Linux FedoraMoodleJun 17, 2026 Nov 9, 2023 N/A· v4 3.3 LOW· v3 N/A· v2 When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting. |
2Fedoraproject Moodle3Extra Packages For Enterprise Linux FedoraMoodleJun 17, 2026 Nov 9, 2023 N/A· v4 3.3 LOW· v3 N/A· v2 Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. |