Moodle

The referrer URL used by MFA required additional sanitizing, rather than being used directly.

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

A flaw was found in Moodle.

A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php.

Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component.

A flaw was found in Moodle in versions 3.11 to 3.11.4.

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions.

An issue was discovered in Moodle 3.x.

Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js.

A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.

A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10.

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php.

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter.

Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts.

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter.

Authenticated users were able to enumerate other users' names via the learning plans page.

A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code.

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file inc…

A limited SQL injection risk was identified in the "browse list of users" site administration page.