Moodle vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
38 matching records
- Medium5.1VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencod…Check if you run itEPSS 0.36%Oct 20, 2026
- Medium6.0Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filt…Check if you run itEPSS 0.39%Oct 20, 2026
- High7.1Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through th…Check if you run itEPSS 0.42%Oct 20, 2026
- Critical9.8SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requestsCheck if you run itEPSS 0.74%Sep 23, 2026
- Medium5.1Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter.Check if you run itEPSS 0.30%May 10, 2026
- Critical9.6mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser.Check if you run itEPSS 0.17%Mar 18, 2026
- Medium6.5A denial-of-service vulnerability was identified in Moodle’s TeX formula editor.Check if you run itEPSS 0.51%Feb 21, 2026
- High7.2A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection.Check this weekEPSS 13.83%Feb 21, 2026
- High7.2A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing.Check if you run itEPSS 0.64%Feb 21, 2026
- UnknownMoodle moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 1.13%Nov 5, 2025
- Medium5.4An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.Check if you run itEPSS 0.22%Oct 23, 2025
- Medium4.3Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups.Check if you run itEPSS 0.27%Oct 23, 2025
- High7.5Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.Check if you run itEPSS 0.40%Oct 23, 2025
- Medium5.3An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.Check if you run itEPSS 0.30%Oct 23, 2025
- Medium4.3Moodle failed to verify enrolment status correctly when sending quiz notifications.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium4.3Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter inCheck if you run itEPSS 0.22%Oct 21, 2025
- Medium5.4Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature.Check if you run itEPSS 0.22%Oct 21, 2025
- Medium5.1geoffrowland jmol Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.78%Jun 23, 2025
- High8.7geoffrowland jmol Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 3.06%Jun 23, 2025
- Medium5.3A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle.Check if you run itEPSS 0.46%May 10, 2025
- Medium5.3A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades.Check if you run itEPSS 0.32%Apr 25, 2025
- High7.5A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—viCheck if you run itEPSS 0.52%Apr 25, 2025
- Medium4.3A flaw was discovered in Moodle.Check if you run itEPSS 0.32%Apr 25, 2025
- Medium4.3A flaw was found in Moodle.Check if you run itEPSS 0.37%Apr 25, 2025
- Medium4.3A flaw was found in Moodle.Check if you run itEPSS 0.33%Apr 25, 2025