Moodle - vulnerabilities (CVEs)

639 CVEs in 6 products, 12 in the last 30 days, newest from 2026-09-30.

Products

Moodle - 637 CVEs
H5p - 2 CVEs
Lms - 1 CVEs
Saml Authentication - 1 CVEs
Virtual Programming Lab - 1 CVEs
Moodle Lms - 0 CVEs

Newest CVEs of Moodle

CVE-2026-102588 - CVSS 6.5 (medium), 2026-09-30: A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user…
CVE-2026-102587 - CVSS 2.7 (low), 2026-09-30: A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager…
CVE-2026-102586 - CVSS 6.1 (medium), 2026-09-30: A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting…
CVE-2026-102585 - CVSS 4.3 (medium), 2026-09-30: A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group…
CVE-2026-102584 - CVSS 4.3 (medium), 2026-09-30: A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without…
CVE-2026-102583 - CVSS 2.7 (low), 2026-09-30: A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an…
CVE-2026-102582 - CVSS 4.3 (medium), 2026-09-30: A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with…
CVE-2026-102581 - CVSS 5.4 (medium), 2026-09-30: A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability.…
CVE-2026-102580 - CVSS 4.3 (medium), 2026-09-30: A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing…
CVE-2026-102579 - CVSS 4.3 (medium), 2026-09-30: A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other…
CVE-2026-102578 - CVSS 8.8 (high), 2026-09-30: A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database…
CVE-2026-102577 - CVSS 4.3 (medium), 2026-09-30: A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote…
CVE-2022-50943 - CVSS 6.1 (medium), 2026-05-10: Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through…
CVE-2026-26046 - CVSS 7.2 (high), 2026-02-21: A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection.…
CVE-2026-26047 - CVSS 6.5 (medium), 2026-02-21: A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits…
CVE-2026-26045 - CVSS 7.2 (high), 2026-02-21: A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a…
CVE-2025-67857 - CVSS 5.3 (medium), 2026-02-03: A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows…
CVE-2025-67849 - CVSS 7.3 (high), 2026-02-03: A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject…
CVE-2025-67852 - CVSS 6.1 (medium), 2026-02-03: A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages…
CVE-2025-67856 - CVSS 9.8 (critical), 2026-02-03: A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be…
CVE-2025-67851 - CVSS 7.8 (high), 2026-02-03: A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit…
CVE-2025-67855 - CVSS 6.1 (medium), 2026-02-03: A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This…
CVE-2025-67850 - CVSS 7.3 (high), 2026-02-03: A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula…
CVE-2025-67853 - CVSS 7.5 (high), 2026-02-03: A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows…
CVE-2025-67848 - CVSS 8.1 (high), 2026-02-03: A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI)…
CVE-2025-67847 - CVSS 8.8 (high), 2026-01-23: A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to…
CVE-2021-47857 - CVSS 7.2 (high), 2026-01-21: Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts.…
CVE-2025-62398 - CVSS 5.4 (medium), 2025-10-23: A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially…
CVE-2025-62401 - CVSS 5.4 (medium), 2025-10-23: An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an…
CVE-2025-62397 - CVSS 5.3 (medium), 2025-10-23: The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.