Filtered by vendor Moodle
Subscribe
Total
614 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-62394 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 4.3 MEDIUM |
| Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information. | |||||
| CVE-2025-62393 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 4.3 MEDIUM |
| A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details. | |||||
| CVE-2025-62395 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 4.3 MEDIUM |
| A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data. | |||||
| CVE-2025-62396 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 5.3 MEDIUM |
| An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured. | |||||
| CVE-2025-62397 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 5.3 MEDIUM |
| The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance. | |||||
| CVE-2025-62398 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 5.4 MEDIUM |
| A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts. | |||||
| CVE-2025-62399 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 7.5 HIGH |
| Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks. | |||||
| CVE-2025-62400 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 4.3 MEDIUM |
| Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information. | |||||
| CVE-2025-62401 | 1 Moodle | 1 Moodle | 2025-11-14 | N/A | 5.4 MEDIUM |
| An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment. | |||||
| CVE-2025-26530 | 1 Moodle | 1 Moodle | 2025-08-11 | N/A | 8.3 HIGH |
| The question bank filter required additional sanitizing to prevent a reflected XSS risk. | |||||
| CVE-2025-26525 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 8.6 HIGH |
| Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed). | |||||
| CVE-2025-26526 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 6.5 MEDIUM |
| Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. | |||||
| CVE-2025-26527 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 5.3 MEDIUM |
| Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. | |||||
| CVE-2025-26528 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 3.4 LOW |
| The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. | |||||
| CVE-2025-26529 | 1 Moodle | 1 Moodle | 2025-08-08 | N/A | 8.3 HIGH |
| Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. | |||||
| CVE-2024-38277 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-08-07 | N/A | 5.4 MEDIUM |
| A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. | |||||
| CVE-2024-38274 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-08-07 | N/A | 6.1 MEDIUM |
| Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. | |||||
| CVE-2024-38273 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2025-08-07 | N/A | 5.4 MEDIUM |
| Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. | |||||
| CVE-2025-26531 | 1 Moodle | 1 Moodle | 2025-08-07 | N/A | 3.1 LOW |
| Insufficient capability checks made it possible to disable badges a user does not have permission to access. | |||||
| CVE-2025-26532 | 1 Moodle | 1 Moodle | 2025-08-06 | N/A | 3.1 LOW |
| Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. | |||||