# cve.now: Moodle

The newest entries naming Moodle as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2022-50943](https://cve.now/CVE-2022-50943.md): Moodle LMS 4.0 Cross-Site Scripting via course search.php (CVSS 5.1)
- [CVE-2021-47857](https://cve.now/CVE-2021-47857.md): Moodle 3.10.3 - 'label' Persistent Cross Site Scripting (CVSS 5.1)
- [CVE-2025-34032](https://cve.now/CVE-2025-34032.md): Moodle LMS Jmol Plugin Cross-site Scripting (XSS) (CVSS 5.1)
- [CVE-2025-34031](https://cve.now/CVE-2025-34031.md): Moodle LMS Jmol Plugin Path Traversal (CVSS 8.7)
- [CVE-2025-53021](https://cve.now/CVE-2025-53021.md): A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey para (CVSS 4.2)
- [CVE-2024-38277](https://cve.now/CVE-2024-38277.md): moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys (CVSS 5.4)
- [CVE-2024-38276](https://cve.now/CVE-2024-38276.md): moodle: CSRF risks due to misuse of confirm\_sesskey (CVSS 8.8)
- [CVE-2024-38275](https://cve.now/CVE-2024-38275.md): moodle: HTTP authorization header is preserved between "emulated redirects" (CVSS 7.5)
- [CVE-2024-38274](https://cve.now/CVE-2024-38274.md): moodle: stored XSS via calendar's event title when deleting the event (CVSS 6.1)
- [CVE-2024-38273](https://cve.now/CVE-2024-38273.md): moodle: BigBlueButton web service leaks meeting joining information to users who should not have access (CVSS 5.4)
- [CVE-2024-33996](https://cve.now/CVE-2024-33996.md): moodle: broken access control when setting calendar event type (CVSS 6.2)
- [CVE-2024-1439](https://cve.now/CVE-2024-1439.md): Inadequate access control vulnerability in Moodle (CVSS 6.5)
- [CVE-2012-1161](https://cve.now/CVE-2012-1161.md): Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results (no CVSS)
- [CVE-2012-1170](https://cve.now/CVE-2012-1170.md): Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough (no CVSS)
- [CVE-2012-1169](https://cve.now/CVE-2012-1169.md): Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names (no CVSS)
- [CVE-2012-1160](https://cve.now/CVE-2012-1160.md): Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php (no CVSS)
- [CVE-2012-1159](https://cve.now/CVE-2012-1159.md): Moodle before 2.2.2: Overview report allows users to see hidden courses (no CVSS)
- [CVE-2012-1158](https://cve.now/CVE-2012-1158.md): Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export (no CVSS)
- [CVE-2012-1157](https://cve.now/CVE-2012-1157.md): Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default (no CVSS)
- [CVE-2012-1156](https://cve.now/CVE-2012-1156.md): Moodle before 2.2.2 has users' private files included in course backups (no CVSS)
- [CVE-2012-1168](https://cve.now/CVE-2012-1168.md): Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified (no CVSS)
- [CVE-2012-1155](https://cve.now/CVE-2012-1155.md): Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even th (no CVSS)
- [CVE-2019-10154](https://cve.now/CVE-2019-10154.md): A flaw was found in Moodle before versions 3.7, 3.6.4. (CVSS 6.5)
- [CVE-2019-10134](https://cve.now/CVE-2019-10134.md): A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. (CVSS 4.2)
- [CVE-2019-10133](https://cve.now/CVE-2019-10133.md): A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. (CVSS 3.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/moodle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.