| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. |
| In Moodle 3.2.x, global search displays user names for unauthenticated users. |
| In Moodle 3.x, XSS can occur via evidence of prior learning. |
| In Moodle 2.x and 3.x, SQL injection can occur via user preferences. |
| In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. |
| Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
| In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
| In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students. |
| In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. |
| In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. |
| In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. |
| In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. |
| In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. |
| Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element. |
| mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher. |
| Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log. |
| mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service. |
| Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task. |
| Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attempt. |
| Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric. |
