Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk

In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions

A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits

A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of…

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course

Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough

Moodle before 2.2.2 has users' private files included in course backups

Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not…

A flaw was found in Moodle before versions 3.7, 3.6.4

Moodle 3.5.x before 3.5.4 allows SSRF

Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the…

lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and…

Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote…

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13

In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed

Moodle: moodle: improper input sanitization in tex filter administration setting

Moodle: moodle: improper validation in file restore functionality leading to remote code execution

A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool

An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during…

Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action

To address a cache poisoning risk in Moodle, additional validation for local storage was required

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load