[MEDIUM] Cross-site Scripting in Moodle Chat

PKSA-dkf4-gr8b-q7z7 CVE-2024-28593 GHSA-f6mh-79vh-2hv7

Affected version: <=4.3.3

Reported by:
GitHub

[HIGH] Uncontrolled Resource Consumption in moodle

PKSA-cnq3-npb7-81gr CVE-2024-25978 GHSA-487g-3m3v-hjhq

Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3

Reported by:
GitHub

[MEDIUM] Improper Handling of Parameters in moodle

PKSA-8zq5-86tq-npgn CVE-2024-25979 GHSA-6vjf-48fh-vxxj

Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3

Reported by:
GitHub

[MEDIUM] Improper Access Control in moodle

PKSA-q882-vvk2-55y5 CVE-2024-25980 GHSA-cp8m-h777-g4p3

Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3

Reported by:
GitHub

[MEDIUM] Improper Access Control in moodle

PKSA-1rtr-36p9-m5t2 CVE-2024-25981 GHSA-jfrg-9hpq-9hvp

Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3

Reported by:
GitHub

[MEDIUM] Cross-Site Request Forgery in moodle

PKSA-ywdp-r6kr-8xch CVE-2024-25982 GHSA-7pjp-fm93-p6pj

Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3

Reported by:
GitHub

[LOW] Authorization Bypass in moodle

PKSA-yn3d-by8g-nzfj CVE-2024-25983 GHSA-9r26-5w88-qhp9

Affected version: <4.1.9|>=4.2.0,<4.2.6|>=4.3.0,<4.3.3

Reported by:
GitHub

[MEDIUM] Moodle Improper Access Control vulnerability

PKSA-57rb-5xt6-dhwq CVE-2024-1439 GHSA-5p2x-8427-9fgp

Affected version: <=4.2.0

Reported by:
GitHub

[MEDIUM] Moodle Cross-site Scripting vulnerability

PKSA-nw4f-rh34-rrdv CVE-2023-5544 GHSA-j5xf-gv89-g422

Affected version: <4.3.0-rc2

Reported by:
GitHub

[LOW] Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability

PKSA-qmp2-c2q6-ys9x CVE-2023-5545 GHSA-26fg-v32r-h663

Affected version: <4.3.0-rc2

Reported by:
GitHub

[LOW] Moodle Cross-site Scripting vulnerability

PKSA-hc6s-n6ty-9y9s CVE-2023-5547 GHSA-9gqp-3g28-w9xc

Affected version: <4.3.0-rc2

Reported by:
GitHub

[LOW] Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability

PKSA-7z8c-xy4p-1ctc CVE-2023-5548 GHSA-cwh2-q44x-5w3c

Affected version: <4.3.0-rc2

Reported by:
GitHub

[LOW] Moodle Improper Access Control vulnerability

PKSA-hfk2-p537-bfvp CVE-2023-5549 GHSA-fm5h-58g2-4m3f

Affected version: <4.3.0-rc2

Reported by:
GitHub

[MEDIUM] Moodle Code Injection vulnerability

PKSA-4qqg-7p6g-qrrf CVE-2023-5550 GHSA-5cvx-cwpx-9rjh

Affected version: <3.9.24|>=3.10.0,<3.11.17|>=4.0.0,<4.0.11|>=4.1.0,<4.1.6|>=4.2.0,<4.2.3|>=4.3.0-beta,<4.3.0-rc2

Reported by:
GitHub

[LOW] Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability

PKSA-6cjp-j4yt-m8jy CVE-2023-5551 GHSA-jr83-8x65-xcr5

Affected version: <3.9.24|>=3.10.0,<3.11.17|>=4.0.0,<4.0.11|>=4.1.0,<4.1.6|>=4.2.0,<4.2.3|>=4.3.0-beta,<4.3.0-rc2

Reported by:
GitHub

[MEDIUM] Moodle Code Injection vulnerability

PKSA-fmy8-x52s-r4tc CVE-2023-5539 GHSA-3xxm-3g3c-w579

Affected version: <4.3.0-rc2

Reported by:
GitHub

[MEDIUM] Moodle Code Injection vulnerability

PKSA-9gb6-31c6-p6xb CVE-2023-5540 GHSA-w8x2-w4qr-v3x4

Affected version: <4.3.0-rc2

Reported by:
GitHub

[LOW] Moodle Cross-site Scripting vulnerability

PKSA-71dn-fkh5-k7hn CVE-2023-5541 GHSA-28gc-4qq5-8q26

Affected version: <4.3.0-rc2

Reported by:
GitHub

[LOW] Moodle Improper Access Control vulnerability

PKSA-d458-bwfk-smkv CVE-2023-5542 GHSA-8mm2-m2gp-c6x2

Affected version: <4.3.0-rc2

Reported by:
GitHub

[MEDIUM] Moodle Cross-site Scripting vulnerability

PKSA-mc6m-hdgk-qpkp CVE-2023-5546 GHSA-9724-h8p7-r3jv

Affected version: <4.3.0-rc2

Reported by:
GitHub

[MEDIUM] Moodle vulnerable to Cross-site Scripting

PKSA-1tyr-r2xr-8vx6 CVE-2023-35131 GHSA-fwfj-8p36-rc64

Affected version: <3.11.15|>=4.0.0,<4.0.9|>=4.1.0,<4.1.4|=4.2.0

Reported by:
GitHub

[MEDIUM] Moodle vulnerable to SQL Injection

PKSA-dhd3-j88c-2sy9 CVE-2023-35132 GHSA-49mv-vfcp-8gg9

Affected version: <3.9.22|>=3.10.0,<3.11.15|>=4.0.0,<4.0.9|>=4.1.0,<4.1.4|=4.2.0

Reported by:
GitHub

[HIGH] Moodle vulnerable to Server Side Request Forgery

PKSA-59yt-9rbk-gvyv CVE-2023-35133 GHSA-xxp4-mf4h-6cwm

Affected version: <3.9.22|>=3.10.0,<3.11.15|>=4.0.0,<4.0.9|>=4.1.0,<4.1.4|=4.2.0

Reported by:
GitHub

[MEDIUM] Moodle vulnerable to stored Cross-site Scripting

PKSA-rn3d-zrrq-myhz CVE-2021-27131 GHSA-w2pm-fr62-jgv4

Affected version: <=3.10.1

Reported by:
GitHub

[MEDIUM] Moodle External Control of File Name or Path vulnerability

PKSA-tkmd-sfy5-9ntm CVE-2023-30943 GHSA-22gj-8qj2-fj46

Affected version: <4.2.0-rc2

Reported by:
GitHub

[HIGH] Moodle SQL Injection vulnerability

PKSA-vvyj-pzxn-byrt CVE-2023-30944 GHSA-7mmc-22g7-3xq2

Affected version: <4.2.0-rc2

Reported by:
GitHub

[MEDIUM] Moodle may allow students to bypass sequential navigation during a quiz attempt

PKSA-s41w-d8tm-rcvv CVE-2022-40208 GHSA-948f-j464-rfj2

Affected version: <3.9.16|>=3.11.0,<3.11.9|>=4.0.0,<4.0.3

Reported by:
GitHub

[MEDIUM] Moodle may display roles to users who don't have access to them

PKSA-mxtf-x1wg-7bp2 CVE-2023-1402 GHSA-vj5p-fp42-774p

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[HIGH] Moodle SQL Injection vulnerability

PKSA-rp95-37zp-mm24 CVE-2023-28329 GHSA-72w2-j52c-7682

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[MEDIUM] Moodle arbitrary file read vulnerability

PKSA-mc13-1wkx-jq4t CVE-2023-28330 GHSA-56r9-72vx-q989

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[MEDIUM] Moodle vulnerable to Cross-site Scripting

PKSA-bxtb-x3pj-rjq1 CVE-2023-28331 GHSA-77jm-f3vj-xvx2

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[MEDIUM] Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional

PKSA-7jf2-xyg3-8k5b CVE-2023-28332 GHSA-9f45-9qrw-pp4v

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[CRITICAL] Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input

PKSA-55x8-drvs-2svz CVE-2023-28333 GHSA-q2x3-2f9g-h559

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[MEDIUM] Moodle may allow authenticated users to enumerate other user's names via learning plans page

PKSA-g5h3-zwb4-389q CVE-2023-28334 GHSA-hh52-g5c4-wprh

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[MEDIUM] Moodle may allow teachers to access the names of users they could not otherwise access

PKSA-fyrz-rtnj-32jm CVE-2023-28336 GHSA-prjm-2fj2-787f

Affected version: <3.9.20|>=3.11.0,<3.11.13|>=4.0.0,<4.0.7|>=4.1.0,<4.1.2

Reported by:
GitHub

[MEDIUM] Moodle has Incorrect Default Permissions

PKSA-p97s-2nyv-wn21 CVE-2021-36397 GHSA-2wmj-8mqg-r9q8

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[MEDIUM] Moodle Cross-site Scripting vulnerability

PKSA-dvwm-fjsh-f11d CVE-2021-36399 GHSA-79jp-m64f-pgrc

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[MEDIUM] Moodle has Incorrect Default Permissions

PKSA-d6ng-xnwt-yqc8 CVE-2021-36400 GHSA-35wf-3wq2-r3hx

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[MEDIUM] Moodle vulnerable to Stored Cross-site Scripting

PKSA-6thw-4qmq-h8nv CVE-2021-36401 GHSA-g6h6-4fp6-w33w

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[MEDIUM] Moodle Improper Input Validation vulnerability

PKSA-rsfn-3wg6-9b49 CVE-2021-36402 GHSA-gv8f-43pg-c5qw

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[MEDIUM] Moodle has a Hidden Functionality vulnerability

PKSA-9gf2-4rwz-pbz6 CVE-2021-36403 GHSA-j9cw-5cpj-9qj5

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[CRITICAL] Moodle SQL Injection vulnerability

PKSA-fvzz-7jy5-jqd2 CVE-2021-36392 GHSA-qc86-vgf2-6fq6

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[CRITICAL] Moodle SQL Injection vulnerability

PKSA-4hr3-sj2q-bthv CVE-2021-36393 GHSA-f46j-r7q3-6cm2

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[HIGH] Moodle Session Fixation vulnerability

PKSA-p137-z8ts-57qr CVE-2021-36394 GHSA-2563-fp9c-mgm8

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[HIGH] Moodle vulnerable to Uncontrolled Resource Consumption

PKSA-gr2v-z4dh-7y8z CVE-2021-36395 GHSA-273w-7fxj-pcp6

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[HIGH] Moodle vulnerable to Server-Side Request Forgery

PKSA-wqjn-7ff5-5vg5 CVE-2021-36396 GHSA-4rmj-w58m-fvch

Affected version: <3.9.8|>=3.10.0-beta,<3.10.5|>=3.11.0-beta,<3.11.1

Reported by:
GitHub

[MEDIUM] Moodle Cross-site Scripting vulnerability

PKSA-j8km-3bqv-4yq3 CVE-2023-23921 GHSA-97qf-pq7x-964m

Affected version: >=4.1.0-beta,<4.1.1|>=4.0.0-beta,<4.0.6|>=3.10.0,<3.11.12|<3.9.19

Reported by:
GitHub

[HIGH] Moodle Improper Access Control vulnerability

PKSA-9ggk-wqx1-s523 CVE-2023-23923 GHSA-32jc-9p58-p82x

Affected version: >=4.1.0-beta,<4.1.1|>=4.0.0-beta,<4.0.6|>=3.10.0,<3.11.12|<3.9.19

Reported by:
GitHub

[CRITICAL] Moodle remote code execution

PKSA-gn18-mdrw-79m2 CVE-2022-40314 GHSA-2hmm-q272-xmhf

Affected version: >=4.0,<4.0.4|>=3.11,<3.11.10|<3.9.17

Reported by:
GitHub

[MEDIUM] Moodle Cross-site Scripting vulnerability

PKSA-svbd-jdv9-tzjd CVE-2021-36568 GHSA-fm6m-fg23-67jq

Affected version: >=3.11.0,<3.11.10|>=3.10.0,<=3.10.4|<=3.9.7

Reported by:
GitHub

[MEDIUM] Missing permission check in Moodle

PKSA-m6dd-wy5n-1jcz CVE-2021-20283 GHSA-2m72-m5cw-3g9h

Affected version: <3.5.17|>=3.8.0,<3.8.8|>=3.9.0,<3.9.5|>=3.10.0,<3.10.2

Reported by:
GitHub

[MEDIUM] moodle Improper Access Control

PKSA-5myr-qbdk-7wg5 CVE-2019-10189 GHSA-h7xp-7fjp-ghhc

Affected version: <3.5.7|>=3.6.0,<3.6.5|>=3.7.0,<3.7.1

Reported by:
GitHub

[MEDIUM] moodle Improper Access Control

PKSA-mrw7-dxd8-j1dz CVE-2019-10188 GHSA-92q5-2h76-vgmj

Affected version: >=3.7.0,<3.7.1|>=3.6.0,<3.6.5|<3.5.7

Reported by:
GitHub

[MEDIUM] Moodle Open Redirect Vulnerability

PKSA-h548-xjzn-44z4 CVE-2019-10133 GHSA-5xp2-rv4h-mm2q

Affected version: <=3.1.17|>=3.4.0,<=3.4.8|>=3.5.0,<=3.5.5|>=3.6.0,<=3.6.3

Reported by:
GitHub

[HIGH] Moodle Unrestricted file upload vulnerability

PKSA-kpgk-j8s9-6ynw CVE-2016-9187 GHSA-58fm-v4pr-jh8p

Affected version: >=2.0.1,<=3.2.1

Reported by:
GitHub

[MEDIUM] Moodle XSS Vulnerability

PKSA-qzsz-dwgf-596p CVE-2016-9188 GHSA-7ghm-fp7p-qvjq

Affected version: >=2.0.1,<=3.2.1

Reported by:
GitHub

[MEDIUM] Moodle XSS Vulnerability

PKSA-3x5q-rssj-5cz4 CVE-2017-12156 GHSA-7mfw-g8x4-rq2w

Affected version: <=3.1.7|>=3.2.0,<=3.2.4|>=3.3.0,<=3.3.1

Reported by:
GitHub

[MEDIUM] Moodle sensitive information disclosure

PKSA-c1md-j5p9-qkdj CVE-2017-12157 GHSA-gw95-48xq-gqf9

Affected version: <=3.1.7|>=3.2.0,<=3.2.4|>=3.3.0,<=3.3.1

Reported by:
GitHub

[MEDIUM] Moodle Improper Privilege Management

PKSA-32mp-qz4y-gvx3 CVE-2017-7532 GHSA-jjhx-5jff-rc8m

Affected version: <3.1.7|>=3.2.0,<3.2.4|=3.3.0

Reported by:
GitHub

[HIGH] Moodle XML import of ddwtos could lead to intentional remote code execution

PKSA-w7mj-pb7y-rhgn CVE-2018-14630 GHSA-c3pr-h96w-2jjg

Affected version: <3.1.14|>=3.2.0,<3.3.8|>=3.4.0,<3.4.5|>=3.5.0,<3.5.2

Reported by:
GitHub

[MEDIUM] Moodle Stored HTML in assignment submission comments allowed links to be opened directly

PKSA-cjxh-89j3-yvhw CVE-2019-3850 GHSA-3fj7-9j8m-7r8g

Affected version: >=3.6.0,<3.6.3|>=3.5.0,<3.5.5|>=3.2.0,<3.4.8|<3.1.17

Reported by:
GitHub

[HIGH] Moodle Users could elevate their role when accessing the LTI tool on a provider site

PKSA-tsyc-dk7h-qs9g CVE-2019-3849 GHSA-5wg9-5w3f-hxmh

Affected version: >=3.6,<3.6.3|>=3.5,<3.5.5|<3.4.8

Reported by:
GitHub

[MEDIUM] Moodle XSS Vulnerability

PKSA-5wvg-81wj-qh1y CVE-2019-3808 GHSA-4r2p-wpv5-683w

Affected version: <=3.1.15|>=3.2.0,<=3.4.6|>=3.5.0,<=3.5.3|>=3.6.0,<=3.6.1

Reported by:
GitHub

[MEDIUM] Moodle cross-site scripting (XSS) vulnerability

PKSA-mcfm-4qfd-q64n CVE-2014-0218 GHSA-ch68-5r37-p7c3

Affected version: >=2.6.0,<2.6.3|>=2.5.0,<2.5.6|<2.4.10

Reported by:
GitHub

[LOW] Moodle cross-site scripting (XSS) vulnerability

PKSA-2bsx-3byg-qg7b CVE-2014-2571 GHSA-75c6-xqwr-v2r9

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle cross-site request forgery (CSRF) vulnerability

PKSA-3h1s-9b34-f5p2 CVE-2014-0126 GHSA-4wvg-7886-83gv

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle's time-validation implementation allows bypassing intended restrictions

PKSA-tw6p-1xzy-gzn8 CVE-2014-0127 GHSA-6p3g-hw27-qh44

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle multiple cross-site request forgery (CSRF) vulnerabilities

PKSA-4h2d-1zqg-9ycy CVE-2014-0213 GHSA-h75f-hjcr-cvh8

Affected version: >=2.6.0,<2.6.3|>=2.5.0,<2.5.6|<2.4.10

Reported by:
GitHub

[MEDIUM] Moodle creates a MoodleMobile web-service token with an infinite lifetime

PKSA-3d8z-kbcj-jhvx CVE-2014-0214 GHSA-48rq-vj58-2mh6

Affected version: >=2.6.0,<2.6.3|>=2.5.0,<2.5.6|<2.4.10

Reported by:
GitHub

[MEDIUM] Moodle does not properly restrict file access

PKSA-2bvf-j5pg-v8z3 CVE-2014-0216 GHSA-8rc7-4qfv-4484

Affected version: >=2.6.0,<2.6.3|>=2.5.0,<2.5.6|<2.4.10

Reported by:
GitHub

[MEDIUM] Moodle allows bypass of intended access restrictions

PKSA-3fx5-vnx6-p2p3 CVE-2014-0122 GHSA-f9m9-494r-w36p

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle does not properly restrict access

PKSA-mpn4-q6pk-kp1z CVE-2014-0123 GHSA-2vhr-4mhq-m35c

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive information

PKSA-bhg5-9pgg-5dzt CVE-2014-0124 GHSA-fc5p-vj3h-x7g4

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle places a session key in a URL

PKSA-hsbm-pzq5-tfbx CVE-2014-0125 GHSA-j465-7mp6-3xg3

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to bypass intended access restrictions

PKSA-4qgs-3f9g-wc4z CVE-2015-5342 GHSA-6xpm-q8x9-j3rw

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11

Reported by:
GitHub

[MEDIUM] Moodle cross-site scripting (XSS) vulnerabilities

PKSA-62vp-mb56-c3pd CVE-2013-7341 GHSA-j6c3-3c4w-qv8p

Affected version: >=2.6.0,<2.6.2|>=2.5.0,<2.5.5|<2.4.9

Reported by:
GitHub

[MEDIUM] Moodle sensitive information disclosure

PKSA-m9hq-ptn5-f797 CVE-2015-5340 GHSA-mmvj-j7hq-rx85

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|>=2.7.0,<2.7.11|<=2.6.11

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to read SCORM contents

PKSA-vrmn-wxwy-97gm CVE-2015-5341 GHSA-c2r4-f8qv-2v7v

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11

Reported by:
GitHub

[MEDIUM] Moodle Information Disclosure

PKSA-5qj5-11vg-qvk1 CVE-2017-7531 GHSA-w2pj-r8m3-r4jc

Affected version: <3.3.1

Reported by:
GitHub

[MEDIUM] Moodle XSS Vulnerability

PKSA-mtxw-jk4f-m72f CVE-2015-5337 GHSA-2hw6-6rgf-726v

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|>=2.7.0,<2.7.11|<=2.6.11

Reported by:
GitHub

[HIGH] Moodle multiple cross-site request forgery (CSRF) vulnerabilities

PKSA-4bb7-mpff-vp25 CVE-2015-5338 GHSA-v33x-q8gh-4x42

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11

Reported by:
GitHub

[HIGH] Moodle uses predictable password-recovery tokens

PKSA-hfyq-mgbf-xtb3 CVE-2015-5267 GHSA-382v-gxj9-ffhc

Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|<2.7.10

Reported by:
GitHub

[MEDIUM] Moodle mishandles group-based authorization checks

PKSA-11kg-n1m6-bq4m CVE-2015-5268 GHSA-h34c-px28-rjgw

Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|<2.7.10

Reported by:
GitHub

[MEDIUM] Moodle cross-site scripting (XSS) vulnerability

PKSA-zt3k-hnz4-xrj4 CVE-2015-5269 GHSA-5729-822w-j342

Affected version: >=2.9.0,<2.9.2|>=2.8.0,<2.8.8|<2.7.10

Reported by:
GitHub

[MEDIUM] Moodle cross-site request forgery (CSRF) vulnerability

PKSA-6xg5-ptmj-4cn2 CVE-2015-5335 GHSA-hpmv-wvq3-gj27

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11

Reported by:
GitHub

[MEDIUM] Moodle multiple cross-site scripting (XSS) vulnerabilities

PKSA-t3cj-1j63-ywv4 CVE-2015-5336 GHSA-grvw-qq2j-r898

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11

Reported by:
GitHub

[MEDIUM] Moodle does not properly implement group-based access restrictions

PKSA-xv71-1ryj-tkpd CVE-2015-5339 GHSA-gmhr-6f43-7qpj

Affected version: >=2.9.0,<2.9.3|>=2.8.0,<2.8.9|<2.7.11

Reported by:
GitHub

[MEDIUM] Moodle Arbitrary Redirect

PKSA-g4rm-6q21-2mmt CVE-2015-3175 GHSA-h798-h7ff-93xv

Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|>=2.6.0,<2.6.11|<=2.5.9

Reported by:
GitHub

[LOW] Moodle cross-site scripting (XSS) vulnerability

PKSA-pgwx-wjzq-mggw CVE-2015-3178 GHSA-9fmw-m4qx-6cq8

Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive course-structure information

PKSA-6ks7-zmpy-ncf2 CVE-2015-3180 GHSA-688p-pgj4-77hh

Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to bypass file-management restrictions

PKSA-w8kq-dtdw-vgnt CVE-2015-3181 GHSA-622h-cjgg-5mx6

Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11

Reported by:
GitHub

[MEDIUM] Moodle directory traversal vulnerability

PKSA-tp98-8z5s-kbj5 CVE-2015-1493 GHSA-gphj-63h8-r9vq

Affected version: >=2.8.0,<2.8.3|>=2.7.0,<2.7.5|<2.6.8

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information

PKSA-b2x7-jg5t-2g8h CVE-2015-2266 GHSA-35pr-gqm6-r366

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to extract archives to arbitrary directories

PKSA-r8s2-5mc3-pv6n CVE-2015-2267 GHSA-cm4r-58pj-h2ph

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to cause a denial of service

PKSA-q1yp-2nqz-b158 CVE-2015-2268 GHSA-36cm-vrqh-8p98

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9

Reported by:
GitHub

[LOW] Moodle XSS Vulnerability

PKSA-h6c8-tnwx-2f51 CVE-2015-2269 GHSA-cp39-43xr-2wrp

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|>=2.6.0,<2.6.9|<=2.5.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive course information

PKSA-hwvf-5rt9-z24g CVE-2015-2270 GHSA-fp4h-j22r-vwcv

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9

Reported by:
GitHub

[MEDIUM] Moodle does not consider the moodle/tag:flag capability

PKSA-3qsz-9j6v-gm49 CVE-2015-2271 GHSA-v3wp-35g3-m9mm

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to bypass a forced-password-change requirement

PKSA-27xq-htgk-jm9f CVE-2015-2272 GHSA-5659-g9p4-354f

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9

Reported by:
GitHub

[LOW] Moodle cross-site scripting (XSS) vulnerability

PKSA-yw8j-6drp-1cx1 CVE-2015-2273 GHSA-w77v-xpxr-c6pv

Affected version: >=2.8.0,<2.8.4|>=2.7.0,<2.7.6|<2.6.9

Reported by:
GitHub

[LOW] Moodle does not set the RISK_XSS bit for graders

PKSA-kfnw-tfjj-6p3n CVE-2015-3174 GHSA-6r7x-6q98-qcqp

Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11

Reported by:
GitHub

[MEDIUM] Moodle allows attackers obtain full-name information

PKSA-g64b-srdk-yh9x CVE-2015-3176 GHSA-fqrg-vmvj-jv3x

Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11

Reported by:
GitHub

[LOW] Moodle allows attackers to bypass intended login restrictions

PKSA-tgxp-6v2t-d4cw CVE-2015-3179 GHSA-4ppg-2mx6-fqx9

Affected version: >=2.8.0,<2.8.6|>=2.7.0,<2.7.8|<2.6.11

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to bypass a messaging-disabled setting

PKSA-4cdp-42wk-t4nw CVE-2015-0214 GHSA-4jm2-c9jr-6prf

Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7

Reported by:
GitHub

[MEDIUM] Moodle multiple cross-site request forgery (CSRF) vulnerabilities

PKSA-7dsw-mhqq-zggg CVE-2014-7836 GHSA-wpq5-q3mj-8f3r

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to remove wiki pages

PKSA-396c-wmdr-pxzq CVE-2014-7837 GHSA-p3hj-cfhm-7g6v

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle does not consider the moodle/tag:edit capability before adding a tag

PKSA-7bkh-3548-1jd8 CVE-2014-7846 GHSA-468q-9cmp-76wc

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to cause a denial of service

PKSA-f2dm-ppx5-2c2g CVE-2014-7847 GHSA-6vjg-2q57-rgfw

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle does not provide charset information in HTTP headers

PKSA-4y8z-n5wc-bxmp CVE-2014-9059 GHSA-crcq-pw8h-9xwf

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to trigger the generation of arbitrary messages

PKSA-bc4j-ywmc-7mbd CVE-2014-9060 GHSA-c87j-9rrq-h3j8

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive information

PKSA-2zg9-h96f-fxr7 CVE-2015-0211 GHSA-frhc-9hwc-x7j3

Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7

Reported by:
GitHub

[LOW] Moodle cross-site scripting (XSS) vulnerability

PKSA-rdgv-cwk4-rgt1 CVE-2015-0212 GHSA-jj3j-mhgc-g4m4

Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7

Reported by:
GitHub

[MEDIUM] Moodle multiple cross-site request forgery (CSRF) vulnerabilities

PKSA-xy15-xyyj-xchk CVE-2015-0213 GHSA-hhq7-jf2p-hw9c

Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive calendar-event information

PKSA-gfjr-p6fw-dkfr CVE-2015-0215 GHSA-fr9m-pjmm-qx9f

Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to cause a denial of service

PKSA-3sjh-11nk-p5kd CVE-2015-0217 GHSA-p497-37fc-xvvc

Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7

Reported by:
GitHub

[MEDIUM] Moodle cross-site request forgery (CSRF) vulnerability

PKSA-gwzp-t449-t8d2 CVE-2015-0218 GHSA-5jph-mvfm-r27p

Affected version: >=2.8.0,<2.8.2|>=2.7.0,<2.7.4|<2.6.7

Reported by:
GitHub

[MEDIUM] Moodle allows discovery of an author's username

PKSA-8dtb-3dch-zn8d CVE-2014-3617 GHSA-p5j7-26wj-423j

Affected version: >=2.7.0,<2.7.2|>=2.6.0,<2.6.5|<2.5.8

Reported by:
GitHub

[MEDIUM] Moodle has multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module

PKSA-vd8d-53dy-hc1q CVE-2014-7838 GHSA-43r4-vm25-qm78

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle multiple cross-site scripting (XSS) vulnerabilities

PKSA-vx9k-57cm-s586 CVE-2014-3548 GHSA-f66h-6mj2-rwj2

Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11

Reported by:
GitHub

[LOW] Moodle multiple cross-site scripting (XSS) vulnerabilities

PKSA-wwg7-w6tq-nps3 CVE-2014-3551 GHSA-m8f5-9wg8-2c3h

Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11

Reported by:
GitHub

[MEDIUM] Moodle does not enforce the moodle/site:accessallgroups capability requirement

PKSA-6cfx-gy79-92vk CVE-2014-3553 GHSA-mg69-5q59-8jcg

Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|<2.5.7

Reported by:
GitHub

[LOW] Moodle cross-site scripting (XSS) vulnerability

PKSA-7fq1-fs84-nyrr CVE-2014-7830 GHSA-j4mr-vc54-h5pc

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to bypass the mod/lti:view capability requirement

PKSA-3wv9-m6zt-m558 CVE-2014-7832 GHSA-mphj-h2fc-62x3

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive information

PKSA-znjp-qs57-xp64 CVE-2014-7833 GHSA-jq7x-gm9r-v8m7

Affected version: >=2.7.0,<2.7.3|>=2.6.0,<2.6.6|<2.5.9

Reported by:
GitHub

[HIGH] Moodle vulnerable to PHP object injection attacks

PKSA-z489-s91j-4s71 CVE-2014-3541 GHSA-fccf-p8fx-vjj4

Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11

Reported by:
GitHub

[MEDIUM] Moodle allows remote attackers to read arbitrary files

PKSA-mj21-2wqq-9kcc CVE-2014-3542 GHSA-xmwv-mqh8-4xgw

Affected version: =2.7.0|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|>=2.4.0,<2.4.11|<=2.3.11

Reported by:
GitHub

[MEDIUM] Moodle Arbitrary File Read via XML External Entity vulnerability

PKSA-2njy-8329-gfjv CVE-2014-3543 GHSA-27j2-c838-c3qg

Affected version: <=2.4.10|>=2.5.0,<=2.5.6|>=2.6.0,<=2.6.3|=2.7.0

Reported by:
GitHub

[LOW] Moodle cross-site scripting (XSS) vulnerability

PKSA-dw67-sq9s-wcs2 CVE-2014-3544 GHSA-c9jp-244j-vh78

Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain username and course information

PKSA-b4xz-k616-hh1h CVE-2014-3546 GHSA-4c5g-w3gf-rf4f

Affected version: >=2.7.0,<2.7.1|>=2.6.0,<2.6.4|>=2.5.0,<2.5.7|<2.4.11

Reported by:
GitHub

[MEDIUM] Moodle sensitive information disclosure

PKSA-t8kx-3svp-d147 CVE-2016-0724 GHSA-hjrj-7wcj-7j3c

Affected version: >=3.0.0,<3.0.2|>=2.9.0,<2.9.4|>=2.8.0,<2.8.10|>=2.7.0,<2.7.12|<=2.6.11

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to discover student e-mail addresses

PKSA-dkbx-w2rv-cdkf CVE-2016-2151 GHSA-r3fc-hx6q-g6cq

Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13

Reported by:
GitHub

[MEDIUM] Moodle provides calendar-event data without considering whether an activity is hidden

PKSA-z4n4-rs2c-6k1v CVE-2016-2156 GHSA-h8vc-v44p-5r2q

Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13

Reported by:
GitHub

[HIGH] Moodle cross-site request forgery (CSRF) vulnerability

PKSA-1938-5qz6-t3bd CVE-2016-2157 GHSA-f5pm-c4cw-563p

Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13

Reported by:
GitHub

[MEDIUM] Moodle allows attackers to obtain sensitive category-detail information

PKSA-yf1q-wfmq-s1cf CVE-2016-2158 GHSA-m882-j7gq-v9p7

Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|<2.7.13

Reported by:
GitHub

[MEDIUM] Moodle sensitive information disclosure

PKSA-5jbs-pdwn-23gd CVE-2016-2190 GHSA-r9pc-g29w-f86j

Affected version: >=3.0.0,<3.0.3|>=2.9.0,<2.9.5|>=2.8.0,<2.8.11|>=2.7.0,<2.7.13|<=2.6.11

Reported by:
GitHub

[HIGH] Moodle Cross-site request forgery (CSRF) vulnerability

PKSA-6zhw-kkgc-pssc CVE-2016-3734 GHSA-r867-v437-4rrm

Affected version: >=3.0,<3.0.4|>=2.9,<2.9.6|>=2.8,<2.8.12|<2.7.14

Reported by:
GitHub

[MEDIUM] Moodle Authenticated Spelling Binary Remote Code Execution

PKSA-p2wj-rt9d-nvm3 CVE-2013-3630 GHSA-wxqg-fg7v-mmc6

Affected version: <=2.5.2

Reported by:
GitHub

[MEDIUM] Moodle XSS Vulnerability

PKSA-yj7v-phmm-zs3f CVE-2019-3847 GHSA-qrcj-6fjw-3h9h

Affected version: <3.1.17|>=3.2.0,<3.4.8|>=3.5.0,<3.5.5|>=3.6.0,<3.6.3

Reported by:
GitHub

[MEDIUM] Missing authorization in Moodle

PKSA-wnz7-3jhx-ydz3 CVE-2022-0984 GHSA-c5hf-mc85-2hx4

Affected version: <3.9.13|>=3.10.0,<3.10.10|>=3.11.0,<3.11.6

Reported by:
GitHub

[HIGH] SQL Injection in Moodle

PKSA-3tp5-6sqk-x25n CVE-2022-0983 GHSA-h2fw-93qx-vrcq

Affected version: <3.9.13|>=3.10.0,<3.10.10|>=3.11.0,<3.11.6

Reported by:
GitHub

[MEDIUM] Insufficient user authorization in Moodle

PKSA-bnvf-vkcb-sdkk CVE-2022-0334 GHSA-93pj-4p65-qmr9

Affected version: <3.9.11|>=3.10,<3.10.8|>=3.11,<3.11.5

Reported by:
GitHub

[MEDIUM] Cross-Site Request Forgery in Moodle

PKSA-h8xw-wmt7-hqxg CVE-2020-1692 GHSA-9328-7pcw-vw69

Affected version: <3.7.2

Reported by:
GitHub