Priority LOW 24
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to vie…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00285 · Published 2026-10-30 · No fix listed CWE-862
Priority LOW 23
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00217 · Published 2026-10-30 · No fix listed CWE-639
Priority LOW 26
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00215 · Published 2026-10-30 · No fix listed CWE-89
Priority LOW 32
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00419 · Published 2026-10-30 · No fix listed CWE-23
Priority LOW 28
A flaw was found in Moodle.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00198 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-346
Priority LOW 13
A flaw was found in Moodle.
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00238 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-204
Priority LOW 27
A flaw was found in Moodle.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00276 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-79
Priority LOW 19
A flaw was found in Moodle.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00201 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 CWE-842
Priority LOW 19
A flaw was found in Moodle.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00201 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +1 CWE-425
Priority LOW 13
A flaw was found in Moodle.
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00241 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-425
Priority LOW 19
A flaw was found in Moodle.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00196 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-425
Priority LOW 24
A flaw was found in Moodle.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00198 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-79
Priority LOW 20
A flaw was found in Moodle.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00236 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-470
Priority LOW 19
A flaw was found in Moodle.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00228 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-359
Priority LOW 38
A flaw was found in Moodle.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0034 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-89
Priority LOW 20
A flaw was found in Moodle.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00246 · Published 2026-09-30 · Fixed in 5.2.2, 5.1.6 +2 CWE-918
Priority MEDIUM 56
Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter.
CVSS 4.0MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00305 · Published 2026-05-10 · No fix listed CWE-79
Priority LOW 29
A denial-of-service vulnerability was identified in Moodle’s TeX formula editor.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00506 · Published 2026-02-21 · Fixed in 4.5.9, 5.0.5 +1 CWE-400
Priority MEDIUM 49
A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.13829 · Published 2026-02-21 · Fixed in 4.5.9, 5.0.5 +1 CWE-78
Priority LOW 35
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00642 · Published 2026-02-21 · Fixed in 4.5.9, 5.0.5 +1 CWE-94
Priority LOW 24
A flaw was found in moodle.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00357 · Published 2026-02-03 · Fixed in 4.1.22, 4.4.12 +3 CWE-201
Priority MEDIUM 42
A flaw was found in Moodle.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00301 · Published 2026-02-03 · Fixed in 4.1.22, 4.4.12 +3 CWE-863
Priority LOW 27
A flaw was found in mooodle.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00379 · Published 2026-02-03 · Fixed in 4.1.22, 4.4.12 +3 CWE-79
Priority LOW 39
A flaw was found in Moodle.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00463 · Published 2026-02-03 · Fixed in 4.1.22, 4.4.12 +3 CWE-307
Priority LOW 27
A flaw was found in Moodle.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00257 · Published 2026-02-03 · Fixed in 4.1.22, 4.4.12 +3 CWE-601
Load more
THREATIST.IORead the docs