Exposición de Moodle

LMS
114
score de exposición
12.059
sitios usan
0
en explotación
8
críticos

CVEs

313 resultados
CVE-2025-67847HIGHMoodle: moodle: remote code execution via insufficient restore input validationEPSS 0.6%CVE-2025-26533HIGHSQL injection risk in course search module list filterEPSS 0.6%CVE-2022-40208MEDIUMIn Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz atEPSS 0.6%CVE-2020-1755—In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote addreEPSS 0.6%CVE-2022-0984—Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile fEPSS 0.6%CVE-2022-0985—Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary mEPSS 0.6%CVE-2023-28334MEDIUMMoodle: users' name enumeration possible via idor on learning plans pageEPSS 0.6%CVE-2024-33999CRITICALmoodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.phpEPSS 0.5%CVE-2023-5541LOWMoodle: xss risk when using csv grade import methodEPSS 0.5%CVE-2023-5547LOWMoodle: xss risk when previewing data in course upload toolEPSS 0.5%CVE-2024-25980MEDIUMMsa-24-0003: h5p attempts report did not respect activity group settingsEPSS 0.5%CVE-2021-36401MEDIUMIn Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.EPSS 0.5%CVE-2024-43438HIGHMoodle: idor in feedback non-respondents report allows messaging arbitrary site usersEPSS 0.5%CVE-2021-36402MEDIUMIn Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.EPSS 0.5%CVE-2021-36403MEDIUMIn Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which mayEPSS 0.5%CVE-2025-32044HIGHMoodle: unauthenticated rest api user data exposureEPSS 0.5%CVE-2025-26529HIGHStored XSS risk in admin live logEPSS 0.5%CVE-2017-7491—In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview bloEPSS 0.5%CVE-2021-36398MEDIUMIn moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.EPSS 0.5%CVE-2021-36399MEDIUMIn Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.EPSS 0.5%