Moodle Project vulnerabilities
9 vulnerabilities
Known vulnerabilities in Moodle Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Moodle9 vulnerabilities
CVE-2025-26531ubuntumoodle+2
EPSS score0.30%
Insufficient capability checks made it possible to disable badges a user does not have permission to access.CVE-2025-26527ubuntumoodle+2EPSS score0.36%
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.CVE-2025-26528ubuntumoodle+2EPSS score0.29%
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.CVE-2025-26526ubuntumoodle+2EPSS score0.33%
Separate Groups mode restrictions were not factored into permission
checks before allowing viewing or deletion of responses in Feedback
activities.CVE-2025-26533ubuntumoodle+2EPSS score0.56%
An SQL injection risk was identified in the module list filter within course search.CVE-2025-26529ubuntumoodle+2EPSS score0.52%
Description information displayed in the site administration live log
required additional sanitizing to prevent a stored XSS risk.CVE-2025-26525ubuntumoodle+2EPSS score0.44%
Insufficient sanitizing in the TeX notation filter resulted in an
arbitrary file read risk on sites where pdfTeX is available (such as
those with TeX Live installed).CVE-2025-26530ubuntumoodle+2EPSS score0.36%
The question bank filter required additional sanitizing to prevent a reflected XSS risk.CVE-2025-26532ubuntumoodle+2EPSS score0.26%
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.