Exposure of Moodle

LMS
114
exposure score
12,059
sites use
0
exploited
8
critical

CVEs

313 results
CVE-2026-102579MEDIUMMoodle: user profile information disclosure via grade web serviceEPSS 0.2%CVE-2025-62401MEDIUMMoodle: possible to bypass timer in timed assignmentsEPSS 0.2%CVE-2026-119555MEDIUMMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedbackEPSS 0.2%CVE-2026-119554MEDIUMMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumberEPSS 0.2%CVE-2026-102584MEDIUMMoodle: missing capability check allows unauthorised grade penalty recalculationEPSS 0.2%CVE-2026-102585MEDIUMMoodle: group validation missing when enrolling user to courseEPSS 0.2%CVE-2026-102588MEDIUMMoodle: csrf in xml grade importEPSS 0.2%CVE-2026-102581MEDIUMMoodle: xss in forum post templates due to insufficient escapingEPSS 0.2%CVE-2026-102582LOWMoodle: manual enrolment page accessible when plugin disabledEPSS 0.2%CVE-2025-3635LOWMoodle: csrf risk in moodle user tours manager allows tour duplicationEPSS 0.2%CVE-2026-30884CRITICALmdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled KeyEPSS 0.2%CVE-2024-43428HIGHMoodle: cache poisoning via injection into storageEPSS 0.2%CVE-2026-123655HIGHMoodle: missing access checks on h5p content filesEPSS —