MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-32244 | 5.4 | Jun 16 | Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field Affected: 3.10.3 |
| CVE-2021-20280 | 5.4 | Mar 15 | Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17 Affected: 3.5.0 before 3.5.17; 3.8.0 before 3.8.8; 3.9.0 before 3.9.5; 3.10.0 before 3.10.2 |
| CVE-2021-20279 | 5.4 | Mar 15 | The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17 Affected: 3.5.0 before 3.5.17; 3.8.0 before 3.8.8; 3.9.0 before 3.9.5; 3.10.0 before 3.10.2 |
| CVE-2021-20186 | 5.4 | Jan 28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the… Affected: before 3.5.16; 3.8.0 before 3.8.7; 3.9.0 before 3.9.4; 3.10.0 before 3.10.1 |
| CVE-2021-20183 | 5.4 | Jan 28 | It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries Affected: before 3.10.1 |
| CVE-2019-18210 | 5.4 | Feb 11 | Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled… Affected: through 3.7.2 |
| CVE-2019-14879 | 5.4 | Jan 7 | A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9 Affected: 3.5.0 through 3.5.8; 3.6.0 through 3.6.6; 3.7.0 through 3.7.2 |
| CVE-2019-3808 | 5.4 | Mar 25 | A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions Affected: 3.1.0 through 3.1.15; 3.4.0 through 3.4.6; 3.5.0 through 3.5.3; 3.6.0; 3.6.1 |
| CVE-2018-1045 | 5.4 | Jan 22 | In Moodle 3.x, there is XSS via a calendar event name Affected: through 3.1.9; 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; +6 more |
| CVE-2017-7298 | 5.4 | Mar 29 | In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element Affected: 3.2.2 |
| CVE-2016-5014 | 5.4 | Jan 20 | In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +20 more |
| CVE-2016-5013 | 5.4 | Jan 20 | In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam Affected: through 2.7.14; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; +21 more |
| CVE-2015-5336 | 5.4 | Feb 22 | Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2015-5269 | 5.4 | Feb 22 | Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more |
| CVE-2015-5264 | 5.4 | Feb 22 | The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more |
| CVE-2025-67857 | 5.3 | Feb 3 | Moodle: moodle: data exposure of user identifiers in urls Affected: before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-62397 | 5.3 | Oct 23 | Moodle: router produces json instead of 404 error for invalid course id Affected: 5.0.0 before 5.0.3 |
| CVE-2025-62396 | 5.3 | Oct 23 | Moodle: router (r.php) could expose application directories Affected: 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-32045 | 5.3 | Apr 25 | Moodle: hidden grades shown to users without permission on some grade reports Affected: before 4.1.17; 4.3.0 before 4.3.11; 4.4.0 before 4.4.7; 4.5.0 before 4.5.3 |
| CVE-2025-26531 | 5.3 | Feb 24 | Insufficient capability checks made it possible to disable badges a user does not have permission to access Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2025-26527 | 5.3 | Feb 24 | Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-43435 | 5.3 | Nov 11 | A flaw was found in moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43433 | 5.3 | Nov 11 | A flaw was found in moodle Affected: 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43432 | 5.3 | Nov 11 | A flaw was found in moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43430 | 5.3 | Nov 11 | A flaw was found in moodle Affected: 4.4.0 before 4.4.2 |
| CVE-2024-43429 | 5.3 | Nov 11 | A flaw was found in moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-25983 | 5.3 | Feb 19 | Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile… Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2024-25981 | 5.3 | Feb 19 | Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2024-25980 | 5.3 | Feb 19 | Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2024-25979 | 5.3 | Feb 19 | The URL parameters accepted by forum search were not limited to the allowed parameters Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2023-5549 | 5.3 | Nov 9 | Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5548 | 5.3 | Nov 9 | Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5545 | 5.3 | Nov 9 | H5P metadata automatically populated the author with the user's username, which could be sensitive information Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-30943 | 5.3 | May 2 | The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders Affected: 4.1.0 before 4.1.3 |
| CVE-2021-36403 | 5.3 | Mar 6 | In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36402 | 5.3 | Mar 6 | In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36400 | 5.3 | Mar 6 | In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36397 | 5.3 | Mar 6 | In Moodle, insufficient capability checks meant message deletions were not limited to the current user Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2020-1755 | 5.3 | Aug 16 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks Affected: 3.5.0 before 3.5.11; 3.6.0 before 3.6.9; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2022-30597 | 5.3 | May 18 | A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field Affected: 3.9 before 3.9.14; 3.10 before 3.10.11; 3.11 before 3.11.7; 4.0.0 |
| CVE-2021-32473 | 5.3 | Mar 11 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service Affected: before 3.5.18; 3.8.0 before 3.8.9; 3.9.0 before 3.9.7; 3.10.0 before 3.10.4 |
| CVE-2021-43560 | 5.3 | Nov 22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions Affected: through 3.8.8; 3.9.0 before 3.9.11; 3.10.0 before 3.10.8; 3.11.0 before 3.11.4 |
| CVE-2021-20282 | 5.3 | Mar 15 | When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17 Affected: 3.5.0 before 3.5.17; 3.8.0 before 3.8.8; 3.9.0 before 3.9.5; 3.10.0 before 3.10.2 |
| CVE-2021-20281 | 5.3 | Mar 15 | It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17 Affected: 3.5.0 before 3.5.17; 3.8.0 before 3.8.8; 3.9.0 before 3.9.5; 3.10.0 before 3.10.2 |
| CVE-2021-20185 | 5.3 | Jan 28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side… Affected: 3.5.0 before 3.5.16; 3.8.0 before 3.8.7; 3.9.0 before 3.9.4; 3.10.0 |
| CVE-2020-25703 | 5.3 | Nov 19 | The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden Affected: 3.7.0 through 3.7.8; 3.8.0 through 3.8.5; 3.9.0 through 3.9.2 |
| CVE-2020-25701 | 5.3 | Nov 19 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment… Affected: 3.5.0 through 3.5.14; 3.7.0 through 3.7.8; 3.8.0 through 3.8.5; 3.9.0 through 3.9.2 |
| CVE-2019-14883 | 5.3 | Mar 18 | A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's… Affected: 3.6.0 before 3.6.7; 3.7.0 before 3.7.3 |
| CVE-2012-1169 | 5.3 | Nov 14 | Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs Affected: before 2.2.2 |
| CVE-2018-10890 | 5.3 | Jul 10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13 Affected: 3.1.0 before 3.1.13; 3.3.0 before 3.3.7; 3.4.0 before 3.4.4; 3.5.0 before 3.5.1 |
The 500 most important CVEs for this product (exploited first, then by severity)