MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-3809 | 10.0 | Mar 25 | A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions Affected: 3.1.0 through 3.1.15 |
| CVE-2025-67856 | 9.8 | Feb 3 | A flaw was found in Moodle Affected: before 4.1.22; 4.4.0 before 4.4.12; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-26533 | 9.8 | Feb 24 | An SQL injection risk was identified in the module list filter within course search Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-33999 | 9.8 | May 31 | The referrer URL used by MFA required additional sanitizing, rather than being used directly Affected: 4.3.0 before 4.3.4 |
| CVE-2023-5550 | 9.8 | Nov 9 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the… Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-28333 | 9.8 | Mar 23 | The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core… Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2021-36394 | 9.8 | Mar 6 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36393 | 9.8 | Mar 6 | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2021-36392 | 9.8 | Mar 6 | In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses Affected: before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.1 |
| CVE-2022-40315 | 9.8 | Sep 30 | A limited SQL injection risk was identified in the "browse list of users" site administration page Affected: 3.9.0 before 3.9.17; 3.11.0 before 3.11.10; 4.0.0 before 4.0.4 |
| CVE-2022-40314 | 9.8 | Sep 30 | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified Affected: 3.9 before 3.9.17; 3.11 before 3.11.10; 4.0 before 4.0.4 |
| CVE-2022-35649 | 9.8 | Jul 25 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0 before 4.0.2 |
| CVE-2022-30600 | 9.8 | May 18 | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed Affected: 3.9 before 3.9.14; 3.10 before 3.10.11; 3.11 before 3.11.7; 4.0.0 |
| CVE-2022-30599 | 9.8 | May 18 | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria Affected: 3.9 before 3.9.14; 3.10 before 3.10.11; 3.11 before 3.11.7; 4.0.0 |
| CVE-2022-0332 | 9.8 | Jan 25 | A flaw was found in Moodle in versions 3.11 to 3.11.4 Affected: 3.11.0 before 3.11.5 |
| CVE-2021-3943 | 9.8 | Nov 22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions Affected: 3.9.0 through 3.9.10; 3.10.0 through 3.10.7; 3.11.0 through 3.11.3 |
| CVE-2017-2641 | 9.8 | Mar 26 | In Moodle 2.x and 3.x, SQL injection can occur via user preferences Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2022-45152 | 9.1 | Nov 25 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle Affected: before 3.9.18; 3.11.0 before 3.11.11; 4.0.0 before 4.0.5 |
| CVE-2021-21809 | 9.1 | Jun 23 | A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10 Affected: 3.10.0 |
| CVE-2019-14880 | 9.1 | Mar 31 | A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier Affected: 3.5 before 3.5.9; 3.6 before 3.6.7; 3.7 before 3.7.3 |
Showing 20
The 500 most important CVEs for this product (exploited first, then by severity)