TI-2025-19471 CVE-2025-26533 · GHSA-rg56-94j7-hjx9
SQL injection risk in course search module list filter
Priority MEDIUM 44
An SQL injection risk was identified in the module list filter within course search.
Vulnerabilities
8 records
TI-2025-19470 CVE-2025-26532 · GHSA-cw24-f6fq-7j9v
Teachers can evade trusttext config when restoring glossary entries
Priority LOW 20
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
TI-2025-19469 CVE-2025-26531 · GHSA-g88w-v4cq-qgcp
IDOR in badges allows disabling of arbitrary badges
Priority LOW 24
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
TI-2025-19467 CVE-2025-26529 · GHSA-wr88-x8cm-7cgq
Stored XSS risk in admin live log
Priority LOW 39
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
TI-2025-19466 CVE-2025-26528 · GHSA-h697-w4ph-7pcx
Stored XSS in ddimageortext question type
Priority LOW 27
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
TI-2025-19465 CVE-2025-26527 · GHSA-5r85-6h7f-rg3r
Non-searchable tags can still be discovered on the tag search page and in the tags block
Priority LOW 30
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.
TI-2025-19464 CVE-2025-26526 · GHSA-pxg4-xjp7-w9c5
Feedback response viewing and deletions did not respect Separate Groups mode
Priority LOW 35
Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.
TI-2025-19463 CVE-2025-26525 · GHSA-4hmr-39vp-xfrr
Arbitrary file read risk through pdfTeX
Priority MEDIUM 44
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).