Moodle vulnerabilities, page 4
641 vulnerabilities
Known vulnerabilities in Moodle products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
CVE-2021-20187ubuntumoodle+1
EPSS score1.57%
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.CVE-2021-20280ubuntumoodle+2EPSS score1.27%
Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.CVE-2021-20185ubuntumoodle+1EPSS score1.38%
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.CVE-2021-20282ubuntumoodle+2EPSS score1.32%
When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.CVE-2021-20186ubuntumoodle+1EPSS score0.75%
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.CVE-2021-20279ubuntumoodle+2EPSS score1.00%
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.CVE-2021-36393ubuntumoodle+1EPSS score52.30%
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.CVE-2021-36397ubuntumoodle+1EPSS score0.58%
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.CVE-2021-36402ubuntumoodle+1EPSS score0.53%
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.CVE-2021-36398ubuntumoodle+1EPSS score0.52%
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.CVE-2021-36396ubuntumoodle+1EPSS score1.43%
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.CVE-2021-36399ubuntumoodle+1EPSS score0.52%
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.CVE-2021-36403ubuntumoodle+1EPSS score0.53%
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.CVE-2021-36395ubuntumoodle+1EPSS score0.73%
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.CVE-2021-36392ubuntumoodle+1EPSS score0.84%
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.CVE-2021-36394ubuntumoodle+1EPSS score7.03%
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.CVE-2021-36401ubuntumoodle+1EPSS score0.53%
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.CVE-2021-36400ubuntumoodle+1EPSS score0.51%
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.CVE-2021-36568ubuntumoodle+2EPSS score1.04%
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.CVE-2021-43560ubuntumoodle+3EPSS score1.13%
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.