MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-10889 | 5.3 | Jul 10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7 Affected: 3.3.0 before 3.3.7; 3.4.0 before 3.4.4; 3.5.0 before 3.5.1 |
| CVE-2018-1081 | 5.3 | Apr 4 | A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions Affected: through 3.0.10; 3.1 through 3.1.10; 3.2 through 3.2.7; 3.3 through 3.3.4; 3.4.0 through 3.4.1 |
| CVE-2017-7490 | 5.3 | May 15 | In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2016-3731 | 5.3 | Apr 20 | Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +21 more |
| CVE-2017-2643 | 5.3 | Mar 26 | In Moodle 3.2.x, global search displays user names for unauthenticated users Affected: 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; 3.2.0; +2 more |
| CVE-2017-2576 | 5.3 | Jan 20 | In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums Affected: through 2.7.17; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; +31 more |
| CVE-2016-8644 | 5.3 | Jan 20 | In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context Affected: through 2.7.16; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; +27 more |
| CVE-2016-8642 | 5.3 | Jan 20 | In Moodle 2.x and 3.x, the question engine allows access to files that should not be available Affected: through 2.7.16; 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; +27 more |
| CVE-2016-5012 | 5.3 | Jan 20 | In Moodle 3.x, glossary search displays entries without checking user permissions to view them Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0 |
| CVE-2016-2190 | 5.3 | May 22 | Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2021-40694 | 4.9 | Jan 21 | Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account Affected: before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.3 |
| CVE-2021-36401 | 4.8 | Mar 6 | In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2019-3847 | 4.8 | Mar 27 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17 Affected: before 3.1.17; 3.4.0 before 3.4.8; 3.5.0 before 3.5.5; 3.6.0 before 3.6.3 |
| CVE-2026-102585 | 4.3 | Sep 30 | Moodle: group validation missing when enrolling user to course Affected: 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2026-102584 | 4.3 | Sep 30 | Moodle: missing capability check allows unauthorised grade penalty recalculation Affected: 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2026-102582 | 4.3 | Sep 30 | Moodle: manual enrolment page accessible when plugin disabled Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2026-102580 | 4.3 | Sep 30 | Moodle: arbitrary class instantiation via report builder audience classname Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2026-102579 | 4.3 | Sep 30 | Moodle: user profile information disclosure via grade web service Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2026-102577 | 4.3 | Sep 30 | Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2025-62401 | 4.3 | Oct 23 | Moodle: possible to bypass timer in timed assignments Affected: 4.1.0 before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-62395 | 4.3 | Oct 23 | Moodle: external cohort search service leaks system cohort data Affected: 4.1.0 before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-62394 | 4.3 | Oct 23 | Moodle: quiz notifications sent to suspended participants Affected: 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-62393 | 4.3 | Oct 23 | Moodle: course access permissions not properly checked in course_output_fragment_course_overview Affected: 5.0.0 before 5.0.3 |
| CVE-2025-3647 | 4.3 | Apr 25 | Moodle: idor when accessing the cohorts report Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3645 | 4.3 | Apr 25 | Moodle: idor in messaging web service allows access to some user details Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3644 | 4.3 | Apr 25 | Moodle: ajax section delete does not respect course_can_delete_section() Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3640 | 4.3 | Apr 25 | Moodle: idor in web service allows users enrolled in a course to access some details of other users Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3636 | 4.3 | Apr 25 | Moodle: idor in moodle rss block allows unauthorized access to rss feeds Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3628 | 4.3 | Apr 25 | Moodle: moodle assignment submission search leaks anonymous student identities Affected: 4.5.0 before 4.5.4 |
| CVE-2025-3627 | 4.3 | Apr 25 | Moodle: partial data exposure in moodle before completing multi-factor authentication Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3634 | 4.3 | Apr 25 | Moodle: moodle allows course self-enrolment before completing mfa Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-26532 | 4.3 | Feb 24 | Teachers can evade trusttext config when restoring glossary entries Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-48899 | 4.3 | Nov 20 | A vulnerability was found in Moodle Affected: 4.4.0 before 4.4.4 |
| CVE-2024-48901 | 4.3 | Nov 18 | A vulnerability was found in Moodle Affected: through 4.1.14; 4.2.0 through 4.2.11; 4.3.0 through 4.3.8; 4.4.0 through 4.4.4 |
| CVE-2024-48898 | 4.3 | Nov 18 | A vulnerability was found in Moodle Affected: through 4.1.14; 4.2.0 through 4.2.11; 4.3.0 through 4.3.8; 4.4.0 through 4.4.4 |
| CVE-2024-48897 | 4.3 | Nov 18 | A vulnerability was found in Moodle Affected: through 4.1.14; 4.2.0 through 4.2.11; 4.3.0 through 4.3.8; 4.4.0 through 4.4.4 |
| CVE-2024-48896 | 4.3 | Nov 18 | A vulnerability was found in Moodle Affected: through 4.1.14; 4.2.0 through 4.2.11; 4.3.0 through 4.3.8; 4.4.0 through 4.4.4 |
| CVE-2024-48900 | 4.3 | Nov 13 | A vulnerability was found in Moodle Affected: 4.4.0 before 4.4.4 |
| CVE-2024-34006 | 4.3 | May 31 | The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2024-34000 | 4.3 | May 31 | ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2023-5542 | 4.3 | Nov 9 | Students in "Only see own membership" groups could see other students in the group, which should be hidden Affected: 4.2.2 |
| CVE-2022-40208 | 4.3 | Mar 24 | In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt Affected: after 3.9.0 before 3.9.16; after 3.11.0 before 3.11.9; after 4.0.0 before 4.0.3; 3.9.0; 3.11.0; 4.0.0 |
| CVE-2023-28336 | 4.3 | Mar 23 | Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2023-28334 | 4.3 | Mar 23 | Authenticated users were able to enumerate other users' names via the learning plans page Affected: after 4.0.0 before 4.0.7; 4.0.0; 4.1.0; 4.1.1 |
| CVE-2023-1402 | 4.3 | Mar 23 | The course participation report required additional checks to prevent roles being displayed which the user did not have access to view Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2022-40316 | 4.3 | Sep 30 | The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they… Affected: 3.9.0 before 3.9.17; 3.11.0 before 3.11.10; 4.0.0 before 4.0.4 |
| CVE-2020-1754 | 4.3 | Aug 5 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users… Affected: 3.5.0 before 3.5.11; 3.6.0 before 3.6.9; 3.7.0 before 3.7.5; 3.8.0; 3.8.1 |
| CVE-2022-30598 | 4.3 | May 18 | A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it Affected: 3.9 before 3.9.14; 3.10 before 3.10.11; 3.11 before 3.11.7; 4.0.0 |
| CVE-2022-0984 | 4.3 | Apr 29 | Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be… Affected: 3.9.0 before 3.9.13; 3.10.0 before 3.10.10; 3.11.0 before 3.11.6 |
| CVE-2022-0985 | 4.3 | Apr 29 | Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability Affected: before 3.9.13; 3.10.0 before 3.10.10; 3.11.0 before 3.11.6 |
The 500 most important CVEs for this product (exploited first, then by severity)