Moodle vulnerabilities, page 3
641 vulnerabilities
Known vulnerabilities in Moodle products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
CVE-2013-4938moodlemoodle
EPSS score1.14%
The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly support the sendname, sendemailaddr, and acceptgrades settings, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an environment in which there was an ineffective attempt to enable the more secure values.CVE-2013-4524ubuntumoodle+1EPSS score1.84%
Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path.CVE-2013-4341ubuntumoodle+1EPSS score21.86%
Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.CVE-2013-4523ubuntumoodle+1EPSS score1.00%
Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message.CVE-2013-4941moodlemoodle+3EPSS score1.19%
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.CVE-2013-4940moodlemoodle+3EPSS score1.49%
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.CVE-2013-7341ubuntumoodle+2EPSS score2.40%
Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.CVE-2013-5674ubuntumoodle+1EPSS score2.10%
badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter.CVE-2013-3630ubuntumoodle+1EPSS score41.67%
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.CVE-2021-21809ubuntumoodle+1EPSS score24.17%
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.CVE-2021-40695ubuntumoodle+1EPSS score0.85%
It was possible for a student to view their quiz grade before it had been released, using a quiz web service.CVE-2021-40693ubuntumoodle+1EPSS score0.80%
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.CVE-2021-40694ubuntumoodle+1EPSS score0.90%
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.CVE-2021-40691ubuntumoodle+1EPSS score0.71%
A session hijack risk was identified in the Shibboleth authentication plugin.CVE-2021-40692ubuntumoodle+1EPSS score0.63%
Insufficient capability checks made it possible for teachers to download users outside of their courses.CVE-2021-47857moodlemoodleEPSS score0.38%
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. Attackers can craft a calendar event with malicious JavaScript in the subtitle track label to execute arbitrary code when users view the event.CVE-2021-20184ubuntumoodle+1EPSS score0.72%
It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades.CVE-2021-20183ubuntumoodle+1EPSS score0.82%
It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries.CVE-2021-20281ubuntumoodle+2EPSS score1.36%
It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.CVE-2021-20283ubuntumoodle+2EPSS score1.11%
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.