MO
Vendor
Moodle
640
CVEs
0
On KEV
12
New 30D
Products
MO10.0
Moodle
Moodle
637 CVEs0 on KEV12 new
ML6.1
Moodle LMS
Moodle
1 CVEs0 on KEV0 new
SA6.1
Saml Authentication
Moodle
1 CVEs0 on KEV0 new
VP6.1
Virtual Programming Lab
Moodle
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102588 | MO Moodle Moodle | 6.5 | Sep 30 | Moodle: csrf in xml grade import |
| CVE-2026-102587 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: user list filters bypass profile field visibility |
| CVE-2026-102586 | MO Moodle Moodle | 6.1 | Sep 30 | Moodle: xss via password reset link due to insufficient username escaping |
| CVE-2026-102585 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: group validation missing when enrolling user to course |
| CVE-2026-102584 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: missing capability check allows unauthorised grade penalty recalculation |
| CVE-2026-102583 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: incorrect capability check in ai generate image web service |
| CVE-2026-102582 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: manual enrolment page accessible when plugin disabled |
| CVE-2026-102581 | MO Moodle Moodle | 5.4 | Sep 30 | Moodle: xss in forum post templates due to insufficient escaping |
| CVE-2026-102580 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: arbitrary class instantiation via report builder audience classname |
| CVE-2026-102579 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: user profile information disclosure via grade web service |
| CVE-2026-102578 | MO Moodle Moodle | 8.8 | Sep 30 | Moodle: sql injection in question bank web service |
| CVE-2026-102577 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass |
| CVE-2022-50943 | ML Moodle LMS Moodle | 6.1 | May 10 | Moodle LMS 4.0 Cross-Site Scripting via course search.php |
| CVE-2026-26047 | MO Moodle Moodle | 6.5 | Feb 21 | A denial-of-service vulnerability was identified in Moodle’s TeX formula editor |
| CVE-2026-26046 | MO Moodle Moodle | 7.2 | Feb 21 | A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection |
| CVE-2026-26045 | MO Moodle Moodle | 7.2 | Feb 21 | A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing |
| CVE-2025-67857 | MO Moodle Moodle | 5.3 | Feb 3 | A flaw was found in moodle |
| CVE-2025-67856 | MO Moodle Moodle | 9.8 | Feb 3 | A flaw was found in Moodle |
| CVE-2025-67855 | MO Moodle Moodle | 6.1 | Feb 3 | A flaw was found in mooodle |
| CVE-2025-67853 | MO Moodle Moodle | 7.5 | Feb 3 | A flaw was found in Moodle |
| CVE-2025-67852 | MO Moodle Moodle | 6.1 | Feb 3 | A flaw was found in Moodle |
| CVE-2025-67851 | MO Moodle Moodle | 7.8 | Feb 3 | A flaw was found in moodle |
| CVE-2025-67850 | MO Moodle Moodle | 6.1 | Feb 3 | A flaw was found in moodle |
| CVE-2025-67849 | MO Moodle Moodle | 6.1 | Feb 3 | A flaw was found in Moodle |
| CVE-2025-67848 | MO Moodle Moodle | 8.1 | Feb 3 | A flaw was found in Moodle |
| CVE-2025-67847 | MO Moodle Moodle | 8.8 | Jan 23 | A flaw was found in Moodle |
| CVE-2021-47857 | MO Moodle Moodle | 6.1 | Jan 21 | Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts |
| CVE-2025-62401 | MO Moodle Moodle | 4.3 | Oct 23 | An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment |
| CVE-2025-62400 | MO Moodle Moodle | 6.5 | Oct 23 | Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups |
| CVE-2025-62399 | MO Moodle Moodle | 7.5 | Oct 23 | Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks |
| CVE-2025-62398 | MO Moodle Moodle | 5.4 | Oct 23 | A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts |
| CVE-2025-62397 | MO Moodle Moodle | 5.3 | Oct 23 | The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance |
| CVE-2025-62396 | MO Moodle Moodle | 5.3 | Oct 23 | An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured |
| CVE-2025-62395 | MO Moodle Moodle | 4.3 | Oct 23 | A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative… |
| CVE-2025-62394 | MO Moodle Moodle | 4.3 | Oct 23 | Moodle failed to verify enrolment status correctly when sending quiz notifications |
| CVE-2025-62393 | MO Moodle Moodle | 4.3 | Oct 23 | A flaw was found in the course overview output function where user access permissions were not fully enforced |
| CVE-2025-53021 | MO Moodle Moodle | 4.2 | Jun 24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter |
| CVE-2025-3647 | MO Moodle Moodle | 4.3 | Apr 25 | A flaw was discovered in Moodle |
| CVE-2025-3645 | MO Moodle Moodle | 4.3 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3644 | MO Moodle Moodle | 4.3 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3643 | MO Moodle Moodle | 5.4 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3642 | MO Moodle Moodle | 8.8 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3641 | MO Moodle Moodle | 8.8 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3640 | MO Moodle Moodle | 4.3 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3638 | MO Moodle Moodle | 8.8 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3637 | MO Moodle Moodle | 3.1 | Apr 25 | A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL |
| CVE-2025-3636 | MO Moodle Moodle | 4.3 | Apr 25 | A flaw was found in Moodle |
| CVE-2025-3635 | MO Moodle Moodle | 3.5 | Apr 25 | A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request… |
| CVE-2025-3628 | MO Moodle Moodle | 4.3 | Apr 25 | A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities |
| CVE-2025-3627 | MO Moodle Moodle | 4.3 | Apr 25 | A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using… |
| CVE-2025-3625 | MO Moodle Moodle | 7.1 | Apr 25 | A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts,… |
| CVE-2025-32045 | MO Moodle Moodle | 5.3 | Apr 25 | A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades |
| CVE-2025-32044 | MO Moodle Moodle | 7.5 | Apr 25 | A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed… |
| CVE-2025-3634 | MO Moodle Moodle | 4.3 | Apr 25 | A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks |
| CVE-2025-26533 | MO Moodle Moodle | 9.8 | Feb 24 | An SQL injection risk was identified in the module list filter within course search |
| CVE-2025-26532 | MO Moodle Moodle | 4.3 | Feb 24 | Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored |
| CVE-2025-26531 | MO Moodle Moodle | 5.3 | Feb 24 | Insufficient capability checks made it possible to disable badges a user does not have permission to access |
| CVE-2025-26530 | MO Moodle Moodle | 6.1 | Feb 24 | The question bank filter required additional sanitizing to prevent a reflected XSS risk |
| CVE-2025-26529 | MO Moodle Moodle | 6.1 | Feb 24 | Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk |
| CVE-2025-26528 | MO Moodle Moodle | 6.1 | Feb 24 | The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk |