Filtered by vendor Moodle
Subscribe
Total
630 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-62399 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 7.5 HIGH |
| Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks. | |||||
| CVE-2025-62400 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 4.3 MEDIUM |
| Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information. | |||||
| CVE-2025-62401 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 5.4 MEDIUM |
| An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment. | |||||
| CVE-2025-26530 | 1 Moodle | 1 Moodle | 2025-08-11 | N/A | 8.3 HIGH |
| The question bank filter required additional sanitizing to prevent a reflected XSS risk. | |||||
| CVE-2025-26525 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 8.6 HIGH |
| Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed). | |||||
| CVE-2025-26526 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 6.5 MEDIUM |
| Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. | |||||
| CVE-2025-26527 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 5.3 MEDIUM |
| Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. | |||||
| CVE-2025-26528 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 3.4 LOW |
| The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. | |||||
| CVE-2025-26529 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 8.3 HIGH |
| Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. | |||||
| CVE-2024-38277 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-08-07 | N/A | 5.4 MEDIUM |
| A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. | |||||
| CVE-2024-38274 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-08-07 | N/A | 6.1 MEDIUM |
| Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. | |||||
| CVE-2024-38273 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-08-07 | N/A | 5.4 MEDIUM |
| Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. | |||||
| CVE-2025-26531 | 1 Moodle | 1 Moodle | 2025-08-07 | N/A | 3.1 LOW |
| Insufficient capability checks made it possible to disable badges a user does not have permission to access. | |||||
| CVE-2025-26532 | 1 Moodle | 1 Moodle | 2025-08-06 | N/A | 3.1 LOW |
| Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. | |||||
| CVE-2025-26533 | 1 Moodle | 1 Moodle | 2025-08-06 | N/A | 8.1 HIGH |
| An SQL injection risk was identified in the module list filter within course search. | |||||
| CVE-2024-43438 | 1 Moodle | 1 Moodle | 2025-08-05 | N/A | 7.5 HIGH |
| A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report. | |||||
| CVE-2024-43436 | 1 Moodle | 1 Moodle | 2025-08-05 | N/A | 7.2 HIGH |
| A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators. | |||||
| CVE-2024-43426 | 1 Moodle | 1 Moodle | 2025-08-05 | N/A | 7.5 HIGH |
| A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed. | |||||
| CVE-2025-53021 | 1 Moodle | 1 Moodle | 2025-07-09 | N/A | 4.2 MEDIUM |
| A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2025-3628 | 1 Moodle | 1 Moodle | 2025-06-24 | N/A | 4.3 MEDIUM |
| A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. | |||||