MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-35651 | 6.1 | Jul 25 | A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +3 more |
| CVE-2021-32478 | 6.1 | Mar 11 | The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks Affected: before 3.8.9; 3.9.0 before 3.9.7; 3.10.0 before 3.10.4 |
| CVE-2021-43558 | 6.1 | Nov 22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions Affected: through 3.8.8; 3.9.0 before 3.9.11; 3.10.0 before 3.10.8; 3.11.0 before 3.11.4 |
| CVE-2019-14827 | 6.1 | May 17 | A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts Affected: 3.5.0 through 3.5.7; 3.6.0 through 3.6.5; 3.7.0 through 3.7.1 |
| CVE-2019-14831 | 6.1 | Mar 19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced… Affected: 3.5.0 through 3.5.7; 3.6.0 through 3.6.5; 3.7.0 through 3.7.1 |
| CVE-2019-14830 | 6.1 | Mar 19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some… Affected: 3.5.0 through 3.5.7; 3.6.0 through 3.6.5; 3.7.0 through 3.7.1 |
| CVE-2020-25627 | 6.1 | Dec 9 | The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk Affected: 3.9.0 before 3.9.2 |
| CVE-2020-25631 | 6.1 | Dec 8 | A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the… Affected: 3.7.0 before 3.7.8; 3.8.0 before 3.8.5; 3.9.0 before 3.9.2 |
| CVE-2020-25628 | 6.1 | Dec 8 | The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk Affected: 3.5.0 before 3.5.14; 3.7.0 before 3.7.8; 3.8.0 before 3.8.5; 3.9.0 before 3.9.2 |
| CVE-2020-25702 | 6.1 | Nov 19 | In Moodle, it was possible to include JavaScript when re-naming content bank items Affected: 3.9 before 3.9.3 |
| CVE-2019-14884 | 6.1 | Mar 18 | A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages Affected: 3.5.0 before 3.5.9; 3.6.0 before 3.6.7; 3.7.0 through 3.7.3 |
| CVE-2019-14882 | 6.1 | Mar 18 | A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page Affected: 3.5.0 through 3.5.9; 3.6.0 through 3.6.7; 3.7.0 through 3.7.3 |
| CVE-2019-14881 | 6.1 | Mar 18 | A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed Affected: 3.7.0 before 3.7.2 |
| CVE-2019-10133 | 6.1 | Jun 26 | A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18 Affected: 3.1.0 through 3.1.17; 3.4.0 through 3.4.8; 3.5.0 through 3.5.5; 3.6.0 through 3.6.3 |
| CVE-2019-3850 | 6.1 | Mar 26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17 Affected: before 3.1.17; 3.4.0 before 3.4.8; 3.5.0 before 3.5.5; 3.6.0 before 3.6.3 |
| CVE-2019-3810 | 6.1 | Mar 25 | A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions Affected: 3.1.0 through 3.1.15; 3.4.0 through 3.4.6; 3.5.0 through 3.5.3; 3.6.0 through 3.6.1 |
| CVE-2018-14631 | 6.1 | Sep 17 | moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered Affected: 3.3.0 before 3.3.8; 3.4.0 before 3.4.5; 3.5.0 before 3.5.2 |
| CVE-2017-12156 | 6.1 | Sep 18 | Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2017-2645 | 6.1 | Mar 26 | In Moodle 3.x, XSS can occur via attachments to evidence of prior learning Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.1; 3.1.2; +10 more |
| CVE-2017-2644 | 6.1 | Mar 26 | In Moodle 3.x, XSS can occur via evidence of prior learning Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.1; 3.1.2; +10 more |
| CVE-2017-2578 | 6.1 | Jan 20 | In Moodle 3.x, there is XSS in the assignment submission page Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.1; 3.1.2; +8 more |
| CVE-2016-9188 | 6.1 | Nov 4 | Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead,… Affected: through 3.1.2 |
| CVE-2016-2153 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2016-2152 | 6.1 | May 22 | Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2016-0725 | 6.1 | Feb 22 | Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x… Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +10 more |
| CVE-2015-5337 | 6.1 | Feb 22 | Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2015-3275 | 6.1 | Feb 22 | Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more |
| CVE-2015-3274 | 6.1 | Feb 22 | Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +22 more |
| CVE-2024-34003 | 5.9 | May 31 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access… Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2024-37674 | 5.5 | Jun 20 | Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity Affected: 3.10.0 |
| CVE-2026-102581 | 5.4 | Sep 30 | Moodle: xss in forum post templates due to insufficient escaping Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2025-62398 | 5.4 | Oct 23 | A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts Affected: 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-3643 | 5.4 | Apr 25 | A flaw was found in Moodle Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2024-45691 | 5.4 | Nov 20 | A flaw was found in Moodle Affected: before 4.1.13; 4.2.0 before 4.2.10; 4.3.0 before 4.3.7; 4.4.0 before 4.4.3 |
| CVE-2024-38277 | 5.4 | Jun 18 | A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two Affected: 4.1.0 before 4.1.11; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 4.4.0 |
| CVE-2024-38273 | 5.4 | Jun 18 | Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access Affected: 4.1.0 before 4.1.11; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 4.4.0 |
| CVE-2024-33998 | 5.4 | May 31 | Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2024-28593 | 5.4 | Mar 22 | The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation Affected: 4.3.3 |
| CVE-2023-5546 | 5.4 | Nov 9 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk Affected: 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5544 | 5.4 | Nov 9 | Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk Affected: 3.9.0 before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-46858 | 5.4 | Oct 29 | Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher Affected: 4.3.0 |
| CVE-2021-27131 | 5.4 | May 16 | Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer"… Affected: 3.10.1 |
| CVE-2021-36399 | 5.4 | Mar 6 | In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk Affected: 3.11.0 |
| CVE-2021-36398 | 5.4 | Mar 6 | In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk Affected: 3.11.0 |
| CVE-2022-45151 | 5.4 | Nov 23 | The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields Affected: 3.11.0 before 3.11.11; 4.0.0 before 4.0.5 |
| CVE-2022-45149 | 5.4 | Nov 23 | A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL Affected: 3.9.0 before 3.9.18; 3.11.0 before 3.11.11; 4.0.0 before 4.0.5 |
| CVE-2021-36568 | 5.4 | Sep 13 | In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field… Affected: 3.9.7; 3.10.4; 3.11.0 |
| CVE-2020-1691 | 5.4 | Aug 5 | In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting Affected: 3.8.0 |
| CVE-2022-30596 | 5.4 | May 18 | A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk Affected: 3.9 before 3.9.14; 3.10 before 3.10.11; 3.11 before 3.11.7; 4.0.0 |
| CVE-2021-32475 | 5.4 | Mar 11 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk Affected: before 3.5.18; 3.8.0 before 3.8.9; 3.9.0 before 3.9.7; 3.10.0 before 3.10.4 |
The 500 most important CVEs for this product (exploited first, then by severity)