MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-26525 | 8.6 | Feb 24 | Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed) Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-34001 | 8.4 | May 31 | Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2023-23923 | 8.2 | Feb 17 | The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference Affected: 3.9.0 before 3.9.19; 3.11.0 before 3.11.12; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2012-1168 | 8.2 | Nov 14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified Affected: before 2.2.2 |
| CVE-2025-67848 | 8.1 | Feb 3 | A flaw was found in Moodle Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2024-43434 | 8.1 | Nov 7 | The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43425 | 8.1 | Nov 7 | A flaw was found in Moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2018-1137 | 8.1 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2018-1082 | 8.1 | Apr 4 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4 Affected: 3.3.0 through 3.3.4; 3.4.0 through 3.4.1 |
| CVE-2025-67851 | 7.8 | Feb 3 | A flaw was found in moodle Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-67853 | 7.5 | Feb 3 | A flaw was found in Moodle Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-62399 | 7.5 | Oct 23 | Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks Affected: 4.1.0 before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-32044 | 7.5 | Apr 25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed… Affected: 4.5.0 before 4.5.3 |
| CVE-2024-45690 | 7.5 | Nov 20 | A flaw was found in Moodle Affected: before 4.1.13; 4.2.0 before 4.2.10; 4.3.0 before 4.3.7; 4.4.0 before 4.4.3 |
| CVE-2024-43440 | 7.5 | Nov 7 | A flaw was found in moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43438 | 7.5 | Nov 7 | A flaw was found in Feedback Affected: 4.1.0 before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43431 | 7.5 | Nov 7 | A vulnerability was found in Moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43426 | 7.5 | Nov 7 | A flaw was found in pdfTeX Affected: 4.1.0 before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-38275 | 7.5 | Jun 18 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to… Affected: before 4.1.11; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 4.4.0 |
| CVE-2024-34009 | 7.5 | May 31 | Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page Affected: 4.3.0 before 4.3.4 |
| CVE-2024-25978 | 7.5 | Feb 19 | Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2023-35133 | 7.5 | Jun 22 | An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk Affected: before 3.9.22; 3.11.0 before 3.11.15; 4.0.0 before 4.0.9; 4.1.0 before 4.1.4; 4.2.0 |
| CVE-2021-36396 | 7.5 | Mar 6 | In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36395 | 7.5 | Mar 6 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2020-14322 | 7.5 | Aug 16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service Affected: 3.5.0 before 3.5.13; 3.7.0 before 3.7.7; 3.8.0 before 3.8.4; 3.9.0 |
| CVE-2022-35650 | 7.5 | Jul 25 | The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0 before 4.0.2 |
| CVE-2021-32476 | 7.5 | Mar 11 | A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits Affected: before 3.5.18; 3.8.0 before 3.8.9; 3.9.0 before 3.9.7; 3.10.0 before 3.10.4 |
| CVE-2020-25630 | 7.5 | Dec 8 | A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of… Affected: 3.5.0 before 3.5.14; 3.7.0 before 3.7.8; 3.8.0 before 3.8.5; 3.9.0 before 3.9.2 |
| CVE-2020-25699 | 7.5 | Nov 19 | In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course Affected: 3.5.0 through 3.5.14; 3.7.0 through 3.7.8; 3.8.0 through 3.8.5; 3.9.0 through 3.9.2 |
| CVE-2020-25698 | 7.5 | Nov 19 | Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course Affected: 3.5.0 through 3.5.14; 3.7.0 through 3.7.8; 3.8.0 through 3.8.5; 3.9.0 through 3.9.2 |
| CVE-2012-1170 | 7.5 | Nov 14 | Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough Affected: before 2.2.2 |
| CVE-2012-1156 | 7.5 | Nov 14 | Moodle before 2.2.2 has users' private files included in course backups Affected: before 2.2.2 |
| CVE-2012-1155 | 7.5 | Nov 14 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not… Affected: 1.9 before 1.9.17; 2.0 before 2.0.8; 2.1 before 2.1.5; 2.2 before 2.2.2 |
| CVE-2019-10154 | 7.5 | Jun 26 | A flaw was found in Moodle before versions 3.7, 3.6.4 Affected: before 3.6.4 |
| CVE-2019-6970 | 7.5 | Mar 18 | Moodle 3.5.x before 3.5.4 allows SSRF Affected: 3.5.0 before 3.5.4 |
| CVE-2016-7919 | 7.5 | Oct 28 | Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the… Affected: 3.1.2 |
| CVE-2015-5267 | 7.5 | Feb 22 | lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more |
| CVE-2015-3272 | 7.4 | Feb 22 | Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +22 more |
| CVE-2023-30944 | 7.3 | May 2 | The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages Affected: 3.9.0 before 3.9.21; 3.11.0 before 3.11.14; 4.0.0 before 4.0.8; 4.1.0 before 4.1.3 |
| CVE-2018-10891 | 7.3 | Jul 10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13 Affected: 3.1 before 3.1.13; 3.3 before 3.3.7; 3.4 before 3.4.4; 3.5 before 3.5.1 |
| CVE-2016-7038 | 7.3 | Jan 20 | In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed Affected: through 2.7.15; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; +24 more |
| CVE-2026-26046 | 7.2 | Feb 21 | A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection Affected: before 4.5.9; 5.0.0 before 5.0.5; 5.1.0 before 5.1.2 |
| CVE-2026-26045 | 7.2 | Feb 21 | A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing Affected: before 4.5.9; 5.0.0 before 5.0.5; 5.1.0 before 5.1.2 |
| CVE-2024-43436 | 7.2 | Nov 7 | A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators Affected: 4.1.0 before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2020-1756 | 7.2 | Aug 16 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool Affected: 3.5.0 before 3.5.11; 3.6.0 before 3.6.9; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2021-32474 | 7.2 | Mar 11 | An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host Affected: before 3.5.18; 3.8.0 before 3.8.9; 3.9.0 before 3.9.7; 3.10.0 before 3.10.4 |
| CVE-2021-20187 | 7.2 | Jan 28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during… Affected: before 3.5.16; 3.8.0 before 3.8.7; 3.9.0 before 3.9.4; 3.10.0 |
| CVE-2025-3625 | 7.1 | Apr 25 | A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts,… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2024-43428 | 7.1 | Nov 7 | To address a cache poisoning risk in Moodle, additional validation for local storage was required Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2022-40313 | 7.1 | Sep 30 | Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load Affected: 3.9.0 before 3.9.17; 3.11.0 before 3.11.10; 4.0.0 before 4.0.4 |
The 500 most important CVEs for this product (exploited first, then by severity)