MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-3635 | 3.5 | Apr 25 | Moodle: csrf risk in moodle user tours manager allows tour duplication Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2024-1439 | 3.3 | Feb 12 | Inadequate access control in Moodle LMS Affected: through 4.2.11 |
| CVE-2023-5543 | 3.3 | Nov 9 | When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity Affected: 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5551 | 3.3 | Nov 9 | Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2025-3637 | 3.1 | Apr 25 | Moodle: csrf token exposure via url in moodle mod_data module Affected: before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2026-102587 | 2.7 | Sep 30 | Moodle: user list filters bypass profile field visibility Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2026-102583 | 2.7 | Sep 30 | Moodle: incorrect capability check in ai generate image web service Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2012-1160 | 2.7 | Nov 14 | Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php Affected: before 2.2.2 |
| CVE-2015-3181 | – | Jun 1 | files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +29 more |
| CVE-2015-3180 | – | Jun 1 | lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +29 more |
| CVE-2015-3179 | – | Jun 1 | login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +29 more |
| CVE-2015-3178 | – | Jun 1 | Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +29 more |
| CVE-2015-3177 | – | Jun 1 | Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated… Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5 |
| CVE-2015-3176 | – | Jun 1 | The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +29 more |
| CVE-2015-3175 | – | Jun 1 | Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +29 more |
| CVE-2015-3174 | – | Jun 1 | mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +29 more |
| CVE-2015-2273 | – | Jun 1 | Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-2272 | – | Jun 1 | login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-2271 | – | Jun 1 | tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-2270 | – | Jun 1 | lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-2269 | – | Jun 1 | Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-2268 | – | Jun 1 | filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-2267 | – | Jun 1 | mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-2266 | – | Jun 1 | message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +23 more |
| CVE-2015-1493 | – | Jun 1 | Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +21 more |
| CVE-2015-0218 | – | Jun 1 | Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +16 more |
| CVE-2015-0217 | – | Jun 1 | filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +16 more |
| CVE-2015-0216 | – | Jun 1 | access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting… Affected: 2.8.0; 2.8.1 |
| CVE-2015-0215 | – | Jun 1 | calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +16 more |
| CVE-2015-0214 | – | Jun 1 | message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +16 more |
| CVE-2015-0213 | – | Jun 1 | Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +16 more |
| CVE-2015-0212 | – | Jun 1 | Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +16 more |
| CVE-2015-0211 | – | Jun 1 | mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and… Affected: through 2.5.9; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +16 more |
| CVE-2014-9060 | – | Nov 24 | The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-9059 | – | Nov 24 | lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7848 | – | Nov 24 | lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7847 | – | Nov 24 | iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7846 | – | Nov 24 | tag/tag_autocomplete.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not consider the moodle/tag:edit capability before adding a… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7845 | – | Nov 24 | The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7838 | – | Nov 24 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7837 | – | Nov 24 | mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7836 | – | Nov 24 | Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7835 | – | Nov 24 | webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7834 | – | Nov 24 | mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7833 | – | Nov 24 | mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7832 | – | Nov 24 | mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7831 | – | Nov 24 | lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-7830 | – | Nov 24 | Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before… Affected: through 2.4.11; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +13 more |
| CVE-2014-3617 | – | Sep 15 | The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote… Affected: through 2.4.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-3553 | – | Jul 29 | mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +29 more |
The 500 most important CVEs for this product (exploited first, then by severity)