Exposure of Moodle

LMS
114
exposure score
12,059
sites use
0
exploited
8
critical

CVEs

313 results
CVE-2020-25702—In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodleEPSS 1.3%CVE-2021-20280—Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8,EPSS 1.3%CVE-2018-1135—An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle filEPSS 1.3%CVE-2012-1160—Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.phpEPSS 1.2%CVE-2017-12156—Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.EPSS 1.2%CVE-2017-7489—In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.EPSS 1.2%CVE-2019-3808MEDIUMA flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage grEPSS 1.2%CVE-2012-1157—Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by defaultEPSS 1.2%CVE-2016-8642—In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.EPSS 1.2%CVE-2023-28329MEDIUMMoodle: authenticated sql injection via availability checkEPSS 1.2%CVE-2023-28330MEDIUMMoodle: authenticated arbitrary file read through malformed backup fileEPSS 1.2%CVE-2016-8644—In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.EPSS 1.2%CVE-2023-28333CRITICALMoodle: pix helper potential mustache code injection riskEPSS 1.2%CVE-2017-15110—In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students cEPSS 1.2%CVE-2023-30944MEDIUMMoodle: minor sql injection risk in external wiki method for listing pagesEPSS 1.1%CVE-2018-1044—In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.EPSS 1.1%CVE-2021-32478—The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versioEPSS 1.1%CVE-2021-43560—A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capabiliEPSS 1.1%CVE-2019-14881MEDIUMA vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.EPSS 1.1%CVE-2022-40315CRITICALA limited SQL injection risk was identified in the "browse list of users" site administration page.EPSS 1.1%