Exposure of Moodle

LMS
74
exposure score
10,577
sites use
0
exploited
8
critical
Vexday analysis

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

293 results
CVE-2024-34003MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backupEPSS 0.4%CVE-2025-67855MEDIUMMooodle: mooodle: information disclosure and script execution via reflected cross-site scriptingEPSS 0.4%CVE-2024-34007HIGHmoodle: logout CSRF in admin/tool/mfa/auth.phpEPSS 0.4%CVE-2024-34006MEDIUMmoodle: unsanitized HTML in site log for config_log_createdEPSS 0.4%CVE-2024-48900MEDIUMMoodle: idor when accessing list of badge recipientsEPSS 0.4%CVE-2024-43437MEDIUMMoodle: xss risk when restoring malicious course backup fileEPSS 0.3%CVE-2024-43435MEDIUMMoodle: can create global glossary without being adminEPSS 0.3%CVE-2024-43427LOWMoodle: admin presets export tool includes some secrets that should not be exportedEPSS 0.3%CVE-2025-3643MEDIUMMoodle: reflected xss risk in policy toolEPSS 0.3%CVE-2025-67857MEDIUMMoodle: moodle: data exposure of user identifiers in urlsEPSS 0.3%CVE-2024-43429MEDIUMMoodle: user information visibility control issues in gradebook reportsEPSS 0.3%CVE-2024-43432MEDIUMMoodle: authorization headers preserved between "emulated redirects"EPSS 0.3%CVE-2025-3627MEDIUMMoodle: partial data exposure in moodle before completing multi-factor authenticationEPSS 0.3%CVE-2022-50943MEDIUMMoodle LMS 4.0 Cross-Site Scripting via course search.phpEPSS 0.3%CVE-2025-3628MEDIUMMoodle: moodle assignment submission search leaks anonymous student identitiesEPSS 0.3%CVE-2025-3636MEDIUMMoodle: idor in moodle rss block allows unauthorized access to rss feedsEPSS 0.3%CVE-2024-43433MEDIUMMoodle: matrix user/power level management not always working as expected with suspended usersEPSS 0.3%CVE-2024-43430MEDIUMMoodle: lack of access control when using external methods for quiz overridesEPSS 0.3%CVE-2025-26526MEDIUMFeedback response viewing and deletions did not respect Separate Groups modeEPSS 0.3%CVE-2025-3644MEDIUMMoodle: ajax section delete does not respect course_can_delete_section()EPSS 0.3%