MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-32477 | 4.3 | Mar 11 | The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default) Affected: 3.10.0 before 3.10.4 |
| CVE-2021-32472 | 4.3 | Mar 11 | Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances Affected: 3.8.0 before 3.8.9; 3.9.0 before 3.9.7; 3.10.0 before 3.10.4 |
| CVE-2022-0334 | 4.3 | Jan 25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions Affected: through 3.8.9; 3.9.0 through 3.9.11; 3.10.0 before 3.10.9; 3.11.0 before 3.11.5 |
| CVE-2021-40691 | 4.3 | Jan 21 | A session hijack risk was identified in the Shibboleth authentication plugin Affected: before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.3 |
| CVE-2021-40695 | 4.3 | Jan 21 | It was possible for a student to view their quiz grade before it had been released, using a quiz web service Affected: 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.3 |
| CVE-2021-40692 | 4.3 | Jan 21 | Insufficient capability checks made it possible for teachers to download users outside of their courses Affected: 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.3 |
| CVE-2019-14829 | 4.3 | Mar 19 | A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly… Affected: 3.5.0 through 3.5.7; 3.6.0 through 3.6.5; 3.7.0 through 3.7.1 |
| CVE-2019-14828 | 4.3 | Mar 19 | A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were… Affected: 3.5.0 through 3.5.7; 3.6.0 through 3.6.5; 3.7.0 through 3.7.1 |
| CVE-2021-20283 | 4.3 | Mar 15 | The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle… Affected: 3.5.0 before 3.5.17; 3.8.0 before 3.8.8; 3.9.0 before 3.9.5; 3.10.0 before 3.10.2 |
| CVE-2021-20184 | 4.3 | Jan 28 | It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other… Affected: before 3.8.7; 3.9.0 before 3.9.4; 3.10.0 before 3.10.1 |
| CVE-2012-1161 | 4.3 | Nov 14 | Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results Affected: before 2.2.2 |
| CVE-2012-1159 | 4.3 | Nov 14 | Moodle before 2.2.2: Overview report allows users to see hidden courses Affected: before 2.2.2 |
| CVE-2012-1158 | 4.3 | Nov 14 | Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export Affected: before 2.2.2 |
| CVE-2012-1157 | 4.3 | Nov 14 | Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default Affected: before 2.2.2 |
| CVE-2019-10189 | 4.3 | Jul 31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7 Affected: before 3.5.7; 3.6.0 before 3.6.5; 3.7.0 before 3.7.1 |
| CVE-2019-10188 | 4.3 | Jul 31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7 Affected: before 3.5.7; 3.6.0 before 3.6.5; 3.7.0 before 3.7.1 |
| CVE-2019-10187 | 4.3 | Jul 31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7 Affected: before 3.5.7; 3.6.0 before 3.6.5; 3.7.0 before 3.7.1 |
| CVE-2019-3852 | 4.3 | Mar 26 | A vulnerability was found in moodle before version 3.6.3 Affected: before 3.6.3 |
| CVE-2019-3851 | 4.3 | Mar 26 | A vulnerability was found in moodle before versions 3.6.3 and 3.5.5 Affected: 3.5.0 before 3.5.5; 3.6.0 before 3.6.3 |
| CVE-2019-3848 | 4.3 | Mar 26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8 Affected: before 3.4.8; 3.5.0 before 3.5.5; 3.6.0 before 3.6.3 |
| CVE-2018-1136 | 4.3 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2018-1044 | 4.3 | Jan 22 | In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings Affected: through 3.1.9; 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; +7 more |
| CVE-2017-15110 | 4.3 | Nov 20 | In Moodle 3.x, students can find out email addresses of other students in the same course Affected: through 3.0.10; 3.1 through 3.1.8; 3.2 through 3.2.5; 3.3 through 3.3.2 |
| CVE-2017-12157 | 4.3 | Sep 18 | In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +34 more |
| CVE-2017-7531 | 4.3 | Jul 17 | In Moodle 3.3, the course overview block reveals activities in hidden courses Affected: 3.3.0 |
| CVE-2017-7491 | 4.3 | May 15 | In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2016-3733 | 4.3 | Apr 20 | The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite… Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2016-3732 | 4.3 | Apr 20 | The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users… Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2016-8643 | 4.3 | Jan 20 | In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services Affected: through 2.7.16; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; +27 more |
| CVE-2016-2159 | 4.3 | May 22 | The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2016-2158 | 4.3 | May 22 | lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled,… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2016-2156 | 4.3 | May 22 | calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2016-2155 | 4.3 | May 22 | The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage… Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +13 more |
| CVE-2016-2154 | 4.3 | May 22 | admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses… Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +13 more |
| CVE-2016-2151 | 4.3 | May 22 | user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2016-0724 | 4.3 | Feb 22 | The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +23 more |
| CVE-2015-5342 | 4.3 | Feb 22 | The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2015-5341 | 4.3 | Feb 22 | mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2015-5340 | 4.3 | Feb 22 | Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2015-5339 | 4.3 | Feb 22 | The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2015-5335 | 4.3 | Feb 22 | Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2015-5331 | 4.3 | Feb 22 | Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access… Affected: 2.9.0; 2.9.1; 2.9.2 |
| CVE-2015-5272 | 4.3 | Feb 22 | The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to… Affected: 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; +4 more |
| CVE-2015-5268 | 4.3 | Feb 22 | The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more |
| CVE-2015-5265 | 4.3 | Feb 22 | The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more |
| CVE-2015-3273 | 4.3 | Feb 22 | mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows… Affected: 2.9.0 |
| CVE-2025-53021 | 4.2 | Jun 24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter Affected: 3 through 3.11.18 |
The 500 most important CVEs for this product (exploited first, then by severity)