MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-3809 | 10.0 | Mar 25 | A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions Affected: 3.1.0 through 3.1.15 |
| CVE-2025-67856 | 9.8 | Feb 3 | Moodle: moodle: privilege escalation via incomplete role checks in badge awarding Affected: before 4.1.22; 4.4.0 before 4.4.12; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-26533 | 9.8 | Feb 24 | An SQL injection risk was identified in the module list filter within course search Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-33999 | 9.8 | May 31 | The referrer URL used by MFA required additional sanitizing, rather than being used directly Affected: 4.3.0 before 4.3.4 |
| CVE-2023-5550 | 9.8 | Nov 9 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the… Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-28333 | 9.8 | Mar 23 | The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core… Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2021-36394 | 9.8 | Mar 6 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36393 | 9.8 | Mar 6 | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36392 | 9.8 | Mar 6 | In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2022-40315 | 9.8 | Sep 30 | A limited SQL injection risk was identified in the "browse list of users" site administration page Affected: 3.9.0 before 3.9.17; 3.11.0 before 3.11.10; 4.0.0 before 4.0.4 |
| CVE-2022-40314 | 9.8 | Sep 30 | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified Affected: 3.9 before 3.9.17; 3.11 before 3.11.10; 4.0 before 4.0.4 |
| CVE-2022-35649 | 9.8 | Jul 25 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0 before 4.0.2 |
| CVE-2022-30600 | 9.8 | May 18 | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed Affected: 3.9 before 3.9.14; 3.10 before 3.10.11; 3.11 before 3.11.7; 4.0.0 |
| CVE-2022-30599 | 9.8 | May 18 | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria Affected: 3.9 before 3.9.14; 3.10 before 3.10.11; 3.11 before 3.11.7; 4.0.0 |
| CVE-2022-0332 | 9.8 | Jan 25 | A flaw was found in Moodle in versions 3.11 to 3.11.4 Affected: 3.11.0 before 3.11.5 |
| CVE-2021-3943 | 9.8 | Nov 22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions Affected: 3.9.0 through 3.9.10; 3.10.0 through 3.10.7; 3.11.0 through 3.11.3 |
| CVE-2017-2641 | 9.8 | Mar 26 | In Moodle 2.x and 3.x, SQL injection can occur via user preferences Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2022-45152 | 9.1 | Nov 25 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle Affected: before 3.9.18; 3.11.0 before 3.11.11; 4.0.0 before 4.0.5 |
| CVE-2021-21809 | 9.1 | Jun 23 | A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10 Affected: 3.10.0 |
| CVE-2019-14880 | 9.1 | Mar 31 | A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier Affected: 3.5 before 3.5.9; 3.6 before 3.6.7; 3.7 before 3.7.3 |
| CVE-2026-102578 | 8.8 | Sep 30 | Moodle: sql injection in question bank web service Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2025-67847 | 8.8 | Jan 23 | Moodle: moodle: remote code execution via insufficient restore input validation Affected: before 4.1.22; 4.4.0 before 4.4.12; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-3642 | 8.8 | Apr 25 | A flaw was found in Moodle Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3641 | 8.8 | Apr 25 | A flaw was found in Moodle Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3638 | 8.8 | Apr 25 | A flaw was found in Moodle Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2024-38276 | 8.8 | Jun 18 | Incorrect CSRF token checks resulted in multiple CSRF risks Affected: before 4.1.10; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 4.4.0 |
| CVE-2024-34008 | 8.8 | May 31 | Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk Affected: 4.0 before 4.3.4; 4.1 before 4.1.10; 4.2 before 4.2.7 |
| CVE-2024-34007 | 8.8 | May 31 | The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF Affected: 4.3.0 before 4.3.4 |
| CVE-2024-25982 | 8.8 | Feb 19 | The link to update all installed language packs did not include the necessary token to prevent a CSRF risk Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2023-5540 | 8.8 | Nov 9 | A remote code execution risk was identified in the IMSCP activity Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5539 | 8.8 | Nov 9 | A remote code execution risk was identified in the Lesson activity Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-28335 | 8.8 | Mar 23 | The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk Affected: 4.1.0; 4.1.1 |
| CVE-2023-28329 | 8.8 | Mar 23 | Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers) Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2022-2986 | 8.8 | Oct 6 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk Affected: 3.11.0 before 3.11.9; 4.0.0 before 4.0.3 |
| CVE-2020-14321 | 8.8 | Aug 16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course Affected: 3.5.0 before 3.5.13; 3.7.0 before 3.7.7; 3.8.0 before 3.8.4; 3.9.0 |
| CVE-2022-0983 | 8.8 | Mar 25 | An SQL injection risk was identified in Badges code relating to configuring criteria Affected: 3.9.0 before 3.9.13; 3.10.0 before 3.10.10; 3.11.0 before 3.11.6 |
| CVE-2022-0335 | 8.8 | Jan 25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions Affected: through 3.8.9; 3.9.0 before 3.9.12; 3.10.0 before 3.10.9; 3.11.0 before 3.11.5 |
| CVE-2021-43559 | 8.8 | Nov 22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions Affected: through 3.8.8; 3.9.0 before 3.9.11; 3.10.0 before 3.10.8; 3.11.0 before 3.11.4 |
| CVE-2020-25629 | 8.8 | Dec 8 | A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration… Affected: 3.5.0 before 3.5.14; 3.7.0 before 3.7.8; 3.8.0 before 3.8.5; 3.9.0 before 3.9.2 |
| CVE-2020-10738 | 8.8 | May 21 | A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions Affected: 3.5 before 3.5.12; 3.6 before 3.6.10; 3.7 before 3.7.6; 3.8 before 3.8.3 |
| CVE-2019-10186 | 8.8 | Jul 31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7 Affected: before 3.5.7; 3.6.0 before 3.6.5; 3.7.0 before 3.7.1 |
| CVE-2019-3849 | 8.8 | Mar 26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8 Affected: before 3.4.8; 3.5.0 before 3.5.5; 3.6.0 before 3.6.3 |
| CVE-2018-16854 | 8.8 | Nov 26 | A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier Affected: through 3.0.10; 3.1.0 before 3.1.15; 3.3.0 before 3.3.9; 3.4.0 before 3.4.6; 3.5.0 before 3.5.3 |
| CVE-2018-14630 | 8.8 | Sep 17 | moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution Affected: through 3.0.10; 3.1.0 before 3.1.14; 3.3.0 before 3.3.8; 3.4.0 before 3.4.5; 3.5.0 before 3.5.2 |
| CVE-2018-1133 | 8.8 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2016-3734 | 8.8 | Apr 20 | Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote… Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2016-9187 | 8.8 | Nov 4 | Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by… Affected: through 3.1.2 |
| CVE-2016-9186 | 8.8 | Nov 4 | Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by… Affected: through 3.1.2 |
| CVE-2016-2157 | 8.8 | May 22 | Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2015-5338 | 8.8 | Feb 22 | Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
The 500 most important CVEs for this product (exploited first, then by severity)