MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-5332 | 6.8 | Feb 22 | Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts… Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +6 more |
| CVE-2015-5266 | 6.8 | Feb 22 | The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more |
| CVE-2026-102588 | 6.5 | Sep 30 | Moodle: csrf in xml grade import Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2026-26047 | 6.5 | Feb 21 | Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service Affected: before 4.5.9; 5.0.0 before 5.0.5; 5.1.0 before 5.1.2 |
| CVE-2025-62400 | 6.5 | Oct 23 | Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups Affected: 4.1.0 before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-26526 | 6.5 | Feb 24 | Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-45689 | 6.5 | Nov 20 | A flaw was found in Moodle Affected: before 4.1.13; 4.2.0 before 4.2.10; 4.3.0 before 4.3.7; 4.4.0 before 4.4.3 |
| CVE-2024-34005 | 6.5 | May 31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct… Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2024-34004 | 6.5 | May 31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to… Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2024-34002 | 6.5 | May 31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access… Affected: before 4.1.10; 4.2.0 before 4.2.7; after 4.3.0 before 4.3.4 |
| CVE-2023-28330 | 6.5 | Mar 23 | Insufficient sanitizing in backup resulted in an arbitrary file read risk Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2021-40693 | 6.5 | Jan 21 | An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability Affected: before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.3 |
| CVE-2020-25700 | 6.5 | Nov 19 | In moodle, some database module web services allowed students to add entries within groups they did not belong to Affected: 3.5.0 through 3.5.14; 3.7.0 through 3.7.8; 3.8.0 through 3.8.5; 3.9.0 through 3.9.2 |
| CVE-2020-1692 | 6.5 | Feb 17 | Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course Affected: before 3.7.2 |
| CVE-2018-1135 | 6.5 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2018-1134 | 6.5 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2018-1043 | 6.5 | Jan 22 | In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +6 more |
| CVE-2018-1042 | 6.5 | Jan 22 | Moodle 3.x has Server Side Request Forgery in the filepicker Affected: through 3.1.9; 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; +7 more |
| CVE-2017-7532 | 6.5 | Jul 17 | In Moodle 3.x, course creators are able to change system default settings for courses Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.1; 3.1.2; +16 more |
| CVE-2017-2642 | 6.5 | Jul 17 | Moodle 3.x has user fullname disclosure on the user preferences page Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.1; 3.1.2; +16 more |
| CVE-2016-3729 | 6.5 | Apr 20 | The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields… Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2023-35132 | 6.3 | Jun 22 | A limited SQL injection risk was identified on the Mnet SSO access control page Affected: before 3.9.22; 3.11.0 before 3.11.15; 4.0.0 before 4.0.9; 4.1.0 before 4.1.4; 4.2.0 |
| CVE-2017-7489 | 6.3 | May 15 | In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2024-33996 | 6.2 | May 31 | Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish… Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2026-102586 | 6.1 | Sep 30 | Moodle: xss via password reset link due to insufficient username escaping Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2022-50943 | 6.1 | May 10 | Moodle LMS 4.0 Cross-Site Scripting via course search.php Affected: through 4.0.0 |
| CVE-2025-67855 | 6.1 | Feb 3 | A flaw was found in mooodle Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-67852 | 6.1 | Feb 3 | A flaw was found in Moodle Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-67850 | 6.1 | Feb 3 | A flaw was found in moodle Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-67849 | 6.1 | Feb 3 | A flaw was found in Moodle Affected: 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2021-47857 | 6.1 | Jan 21 | Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts Affected: 3.10.3 |
| CVE-2025-26530 | 6.1 | Feb 24 | The question bank filter required additional sanitizing to prevent a reflected XSS risk Affected: 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2025-26529 | 6.1 | Feb 24 | Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2025-26528 | 6.1 | Feb 24 | The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-43439 | 6.1 | Nov 11 | A flaw was found in moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43437 | 6.1 | Nov 11 | A flaw was found in moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-38274 | 6.1 | Jun 18 | Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt Affected: 4.1.0 before 4.1.11; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 4.4.0 |
| CVE-2024-33997 | 6.1 | May 31 | Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2024-29374 | 6.1 | Mar 21 | A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter Affected: 3.10.9 |
| CVE-2023-5547 | 6.1 | Nov 9 | The course upload preview contained an XSS risk for users uploading unsafe data Affected: 3.9.0 before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5541 | 6.1 | Nov 9 | The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content Affected: 3.9.0 before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-35131 | 6.1 | Jun 22 | Content on the groups page required additional sanitizing to prevent an XSS risk Affected: 3.11.0 before 3.11.15; 4.0.0 before 4.0.9; 4.1.0 before 4.1.4; 4.2.0 |
| CVE-2023-28332 | 6.1 | Mar 23 | If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2023-28331 | 6.1 | Mar 23 | Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2023-23922 | 6.1 | Feb 17 | The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search Affected: 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2023-23921 | 6.1 | Feb 17 | The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters Affected: 3.9.0 before 3.9.19; 3.11.0 before 3.11.12; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2022-45150 | 6.1 | Nov 23 | A reflected cross-site scripting vulnerability was discovered in Moodle Affected: 3.9.0 before 3.9.18; 3.11.0 before 3.11.11; 4.0.0 before 4.0.5 |
| CVE-2020-14320 | 6.1 | Aug 16 | In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk Affected: 3.7.0 before 3.7.7; 3.8.0 before 3.8.4; 3.9.0 |
| CVE-2022-35653 | 6.1 | Jul 25 | A reflected XSS issue was identified in the LTI module of Moodle Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +3 more |
| CVE-2022-35652 | 6.1 | Jul 25 | An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0 before 4.0.2 |
The 500 most important CVEs for this product (exploited first, then by severity)