Moodle security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for Moodle. Vendor security advisories are linked on this page.
Built for Operators of this product.
38 public records · 0 security-fix timeline events. 0 published in the last 7 days. 7 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 1
- Medium 2
- Low 0
2026-08-054 issues2026-11-02
Known exploited
View all known exploitedRecently published
Browse catalog- Critical9.8SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requestsCheck if you run itEPSS 0.74%Sep 23, 2026
- Medium5.1Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter.Check if you run itEPSS 0.30%May 10, 2026
- Critical9.6mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser.Check if you run itEPSS 0.17%Mar 18, 2026
- Medium6.5A denial-of-service vulnerability was identified in Moodle’s TeX formula editor.Check if you run itEPSS 0.51%Feb 21, 2026
- High7.2A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection.Check this weekEPSS 13.83%Feb 21, 2026
- High7.2A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing.Check if you run itEPSS 0.64%Feb 21, 2026
- Medium5.4An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.Check if you run itEPSS 0.22%Oct 23, 2025
- Medium4.3Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups.Check if you run itEPSS 0.27%Oct 23, 2025
- High7.5Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.Check if you run itEPSS 0.40%Oct 23, 2025
- Medium5.3An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.Check if you run itEPSS 0.30%Oct 23, 2025