TI-2020-15716 CVE-2020-25700 · GHSA-7h8v-2v8x-h264
SQL injection in moodle
Priority LOW 32
In moodle, some database module web services allowed students to add entries within groups they did not belong to.
Vulnerabilities
6 records
TI-2020-15718 CVE-2020-25702 · GHSA-pgcp-m69h-p2gr
Cross-site scripting in moodle
Priority LOW 30
In Moodle, it was possible to include JavaScript when re-naming content bank items.
TI-2020-15719 CVE-2020-25703 · GHSA-c7v4-m269-4995
Information disclosure in moodle
Priority LOW 27
The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden.
TI-2020-15717 CVE-2020-25701 · GHSA-c9hq-g4q8-w893
Improper access control in moodle
Priority LOW 27
If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method.
TI-2020-15714 CVE-2020-25698 · GHSA-vxhx-gmhm-623c
Improper access control in moodle
Priority LOW 37
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course.
TI-2020-15715 CVE-2020-25699 · GHSA-h77r-rp97-7rv4
Incorrect authorization in moodle
Priority LOW 36
In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course.