Vulnerabilities

TI-2026-65442 CVE-2026-102588 · GHSA-w3pq-x3mm-4hh9

Moodle: csrf in xml grade import

LOW 28

A flaw was found in Moodle.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00198 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-346

TI-2026-65441 CVE-2026-102587 · GHSA-c8cf-cphr-fgxh

Moodle: user list filters bypass profile field visibility

LOW 13

A flaw was found in Moodle.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00238 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-204

TI-2026-65440 CVE-2026-102586 · GHSA-rfv4-mv3r-qx66

Moodle: xss via password reset link due to insufficient username escaping

LOW 27

A flaw was found in Moodle.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-79

TI-2026-65439 CVE-2026-102585 · GHSA-h69r-rprv-j965

Moodle: group validation missing when enrolling user to course

LOW 19

A flaw was found in Moodle.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00201 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 CWE-842

TI-2026-65438 CVE-2026-102584 · GHSA-fqcg-5c9f-c55v

Moodle: missing capability check allows unauthorised grade penalty recalculation

LOW 19

A flaw was found in Moodle.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00201 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +1 CWE-425

TI-2026-65437 CVE-2026-102583 · GHSA-57f5-xvgq-p2v3

Moodle: incorrect capability check in ai generate image web service

LOW 13

A flaw was found in Moodle.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00241 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-425

TI-2026-65436 CVE-2026-102582 · GHSA-5rpx-cfm4-5485

Moodle: manual enrolment page accessible when plugin disabled

LOW 19

A flaw was found in Moodle.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00196 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-425

TI-2026-65435 CVE-2026-102581 · GHSA-g6pg-29qv-3h3r

Moodle: xss in forum post templates due to insufficient escaping

LOW 24

A flaw was found in Moodle.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00198 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-79

TI-2026-65434 CVE-2026-102580 · GHSA-xw58-hp5c-6wc2

Moodle: arbitrary class instantiation via report builder audience classname

LOW 20

A flaw was found in Moodle.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00236 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-470

TI-2026-65433 CVE-2026-102579 · GHSA-q3h7-pfg7-m3c3

Moodle: user profile information disclosure via grade web service

LOW 19

A flaw was found in Moodle.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-359

TI-2026-65432 CVE-2026-102578 · GHSA-hvr9-w78p-rcfj

Moodle: sql injection in question bank web service

LOW 38

A flaw was found in Moodle.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0034 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-89

TI-2026-65431 CVE-2026-102577 · GHSA-29qm-g73m-2r7h

Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

LOW 20

A flaw was found in Moodle.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00246 Published 2026-09-30 Fixed in 5.2.2, 5.1.6 +2 CWE-918

TI-2022-26395 CVE-2022-50943 · GHSA-f439-48pp-hm2q

Moodle LMS 4.0 Cross-Site Scripting via course search.php

MEDIUM 56

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00305 Published 2026-05-10 No fix listed CWE-79

TI-2026-21052 CVE-2026-26047 · GHSA-cg8j-5cr2-568q

Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service

LOW 29

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00506 Published 2026-02-21 Fixed in 4.5.9, 5.0.5 +1 CWE-400

TI-2026-21051 CVE-2026-26046 · GHSA-4g4j-v56v-2w79

Moodle: moodle: improper input sanitization in tex filter administration setting

MEDIUM 49

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.13829 Published 2026-02-21 Fixed in 4.5.9, 5.0.5 +1 CWE-78

TI-2026-21050 CVE-2026-26045 · GHSA-ggxq-2mg9-8966

Moodle: moodle: improper validation in file restore functionality leading to remote code execution

LOW 35

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00642 Published 2026-02-21 Fixed in 4.5.9, 5.0.5 +1 CWE-94

TI-2025-41495 CVE-2025-67857 · GHSA-8jrv-wx83-w3xj

Moodle: moodle: data exposure of user identifiers in urls

LOW 24

A flaw was found in moodle.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00357 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-201

TI-2025-41494 CVE-2025-67856 · GHSA-hcm6-q6pc-xfhm

Moodle: moodle: privilege escalation via incomplete role checks in badge awarding

MEDIUM 42

A flaw was found in Moodle.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00301 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-863

TI-2025-41493 CVE-2025-67855 · GHSA-vwhw-vp9v-q9c9

Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting

LOW 27

A flaw was found in mooodle.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00379 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-79

TI-2025-41492 CVE-2025-67853 · GHSA-5cx4-w4fh-fr57

Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service

LOW 39

A flaw was found in Moodle.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00463 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-307

TI-2025-41491 CVE-2025-67852 · GHSA-qv78-6gpp-hm68

Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.

LOW 27

A flaw was found in Moodle.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00257 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-601

TI-2025-41490 CVE-2025-67851 · GHSA-qfh6-h7j6-fvjv

Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export

LOW 34

A flaw was found in moodle.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00286 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-1236

TI-2025-41489 CVE-2025-67850 · GHSA-6mmv-f6c6-v6q8

Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor

LOW 34

A flaw was found in moodle.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00303 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-79

TI-2025-41488 CVE-2025-67849 · GHSA-mhf6-pp52-8wqj

Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses

LOW 34

A flaw was found in Moodle.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00264 Published 2026-02-03 Fixed in 4.5.8, 5.0.4 +3 CWE-79

TI-2025-41487 CVE-2025-67848 · GHSA-j5jv-w5cw-j9ff

Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.

LOW 37

A flaw was found in Moodle.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00414 Published 2026-02-03 Fixed in 4.1.22, 4.4.12 +3 CWE-280

Vulnerabilities

Filters