Moodle vulnerabilities
25 CVEs and advisories name Moodle as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-50943Moodle LMS 4.0 Cross-Site Scripting via course search.php
- CVE-2021-47857Moodle 3.10.3 - 'label' Persistent Cross Site Scripting
- CVE-2025-34032Moodle LMS Jmol Plugin Cross-site Scripting (XSS)
- CVE-2025-34031Moodle LMS Jmol Plugin Path Traversal
- CVE-2025-53021A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey para
- CVE-2024-38277moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
- CVE-2024-38276moodle: CSRF risks due to misuse of confirm_sesskey
- CVE-2024-38275moodle: HTTP authorization header is preserved between "emulated redirects"
- CVE-2024-38274moodle: stored XSS via calendar's event title when deleting the event
- CVE-2024-38273moodle: BigBlueButton web service leaks meeting joining information to users who should not have access
- CVE-2024-33996moodle: broken access control when setting calendar event type
- CVE-2024-1439Inadequate access control vulnerability in Moodle
- CVE-2012-1161Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results
- CVE-2012-1170Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough
- CVE-2012-1169Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names
- CVE-2012-1160Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php
- CVE-2012-1159Moodle before 2.2.2: Overview report allows users to see hidden courses
- CVE-2012-1158Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export
- CVE-2012-1157Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
- CVE-2012-1156Moodle before 2.2.2 has users' private files included in course backups
- CVE-2012-1168Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified
- CVE-2012-1155Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even th
- CVE-2019-10154A flaw was found in Moodle before versions 3.7, 3.6.4.
- CVE-2019-10134A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18.
- CVE-2019-10133A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18.