MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102578 | 8.8 | Sep 30 | Moodle: sql injection in question bank web service Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2025-67847 | 8.8 | Jan 23 | Moodle: moodle: remote code execution via insufficient restore input validation Affected: before 4.1.22; 4.4.0 before 4.4.12; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-3642 | 8.8 | Apr 25 | A flaw was found in Moodle Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3641 | 8.8 | Apr 25 | A flaw was found in Moodle Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3638 | 8.8 | Apr 25 | A flaw was found in Moodle Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2024-38276 | 8.8 | Jun 18 | Incorrect CSRF token checks resulted in multiple CSRF risks Affected: before 4.1.10; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 4.4.0 |
| CVE-2024-34008 | 8.8 | May 31 | Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk Affected: 4.0 before 4.3.4; 4.1 before 4.1.10; 4.2 before 4.2.7 |
| CVE-2024-34007 | 8.8 | May 31 | The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF Affected: 4.3.0 before 4.3.4 |
| CVE-2024-25982 | 8.8 | Feb 19 | The link to update all installed language packs did not include the necessary token to prevent a CSRF risk Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2023-5540 | 8.8 | Nov 9 | A remote code execution risk was identified in the IMSCP activity Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5539 | 8.8 | Nov 9 | A remote code execution risk was identified in the Lesson activity Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-28335 | 8.8 | Mar 23 | The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk Affected: 4.1.0; 4.1.1 |
| CVE-2023-28329 | 8.8 | Mar 23 | Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers) Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2022-2986 | 8.8 | Oct 6 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk Affected: 3.11.0 before 3.11.9; 4.0.0 before 4.0.3 |
| CVE-2020-14321 | 8.8 | Aug 16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course Affected: 3.5.0 before 3.5.13; 3.7.0 before 3.7.7; 3.8.0 before 3.8.4; 3.9.0 |
| CVE-2022-0983 | 8.8 | Mar 25 | An SQL injection risk was identified in Badges code relating to configuring criteria Affected: 3.9.0 before 3.9.13; 3.10.0 before 3.10.10; 3.11.0 before 3.11.6 |
| CVE-2022-0335 | 8.8 | Jan 25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions Affected: through 3.8.9; 3.9.0 before 3.9.12; 3.10.0 before 3.10.9; 3.11.0 before 3.11.5 |
| CVE-2021-43559 | 8.8 | Nov 22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions Affected: through 3.8.8; 3.9.0 before 3.9.11; 3.10.0 before 3.10.8; 3.11.0 before 3.11.4 |
| CVE-2020-25629 | 8.8 | Dec 8 | A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration… Affected: 3.5.0 before 3.5.14; 3.7.0 before 3.7.8; 3.8.0 before 3.8.5; 3.9.0 before 3.9.2 |
| CVE-2020-10738 | 8.8 | May 21 | A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions Affected: 3.5 before 3.5.12; 3.6 before 3.6.10; 3.7 before 3.7.6; 3.8 before 3.8.3 |
| CVE-2019-10186 | 8.8 | Jul 31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7 Affected: before 3.5.7; 3.6.0 before 3.6.5; 3.7.0 before 3.7.1 |
| CVE-2019-3849 | 8.8 | Mar 26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8 Affected: before 3.4.8; 3.5.0 before 3.5.5; 3.6.0 before 3.6.3 |
| CVE-2018-16854 | 8.8 | Nov 26 | A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier Affected: through 3.0.10; 3.1.0 before 3.1.15; 3.3.0 before 3.3.9; 3.4.0 before 3.4.6; 3.5.0 before 3.5.3 |
| CVE-2018-14630 | 8.8 | Sep 17 | moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution Affected: through 3.0.10; 3.1.0 before 3.1.14; 3.3.0 before 3.3.8; 3.4.0 before 3.4.5; 3.5.0 before 3.5.2 |
| CVE-2018-1133 | 8.8 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2016-3734 | 8.8 | Apr 20 | Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote… Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2016-9187 | 8.8 | Nov 4 | Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by… Affected: through 3.1.2 |
| CVE-2016-9186 | 8.8 | Nov 4 | Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by… Affected: through 3.1.2 |
| CVE-2016-2157 | 8.8 | May 22 | Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2015-5338 | 8.8 | Feb 22 | Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2025-26525 | 8.6 | Feb 24 | Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed) Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-34001 | 8.4 | May 31 | Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2023-23923 | 8.2 | Feb 17 | The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference Affected: 3.9.0 before 3.9.19; 3.11.0 before 3.11.12; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2012-1168 | 8.2 | Nov 14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified Affected: before 2.2.2 |
| CVE-2025-67848 | 8.1 | Feb 3 | Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access. Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2024-43434 | 8.1 | Nov 7 | The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43425 | 8.1 | Nov 7 | A flaw was found in Moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2018-1137 | 8.1 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2018-1082 | 8.1 | Apr 4 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4 Affected: 3.3.0 through 3.3.4; 3.4.0 through 3.4.1 |
| CVE-2025-67851 | 7.8 | Feb 3 | Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-67853 | 7.5 | Feb 3 | Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-62399 | 7.5 | Oct 23 | Moodle: password brute force risk when mobile/web services enabled Affected: 4.1.0 before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-32044 | 7.5 | Apr 25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed… Affected: 4.5.0 before 4.5.3 |
| CVE-2024-45690 | 7.5 | Nov 20 | A flaw was found in Moodle Affected: before 4.1.13; 4.2.0 before 4.2.10; 4.3.0 before 4.3.7; 4.4.0 before 4.4.3 |
| CVE-2024-43440 | 7.5 | Nov 7 | A flaw was found in moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43438 | 7.5 | Nov 7 | A flaw was found in Feedback Affected: 4.1.0 before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43431 | 7.5 | Nov 7 | A vulnerability was found in Moodle Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43426 | 7.5 | Nov 7 | A flaw was found in pdfTeX Affected: 4.1.0 before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-38275 | 7.5 | Jun 18 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to… Affected: before 4.1.11; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 4.4.0 |
| CVE-2024-34009 | 7.5 | May 31 | Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page Affected: 4.3.0 before 4.3.4 |
The 500 most important CVEs for this product (exploited first, then by severity)