Exposición de Moodle

LMS
74
score de exposición
10.577
sitios usan
0
en explotación
8
críticos
Análisis Vexday

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

293 resultados
CVE-2021-36400MEDIUMIn Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.EPSS 0.5%CVE-2024-25982MEDIUMMsa-24-0005: csrf risk in language import utilityEPSS 0.5%CVE-2024-34000MEDIUMmoodle: stored XSS in lesson overview report via user ID numberEPSS 0.5%CVE-2024-34002MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupEPSS 0.5%CVE-2024-34005MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupEPSS 0.5%CVE-2024-43431HIGHMoodle: idor in badges allows deletion of arbitrary badgesEPSS 0.5%CVE-2024-34004MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupEPSS 0.5%CVE-2024-38276HIGHmoodle: CSRF risks due to misuse of confirm_sesskeyEPSS 0.5%CVE-2026-26047MEDIUMMoodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of serviceEPSS 0.5%CVE-2021-4399MEDIUMEdwiser Bridge <= 2.0.6 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2024-38275HIGHmoodle: HTTP authorization header is preserved between "emulated redirects"EPSS 0.4%CVE-2025-26525HIGHArbitrary file read risk through pdfTeXEPSS 0.4%CVE-2025-67853HIGHMoodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email serviceEPSS 0.4%CVE-2023-5542LOWMoodle: students can view other users in "only see own membership" groupsEPSS 0.4%CVE-2024-38273MEDIUMmoodle: BigBlueButton web service leaks meeting joining information to users who should not have accessEPSS 0.4%CVE-2022-2986—Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.EPSS 0.4%CVE-2024-34009HIGHmoodle: ReCAPTCHA can be bypassed on the login pageEPSS 0.4%CVE-2024-45691MEDIUMMoodle: lesson activity password bypass through php loose comparisonEPSS 0.4%CVE-2022-45149MEDIUMA vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's EPSS 0.4%CVE-2023-28335HIGHMoodle: csrf risk in resetting all templates of a database activityEPSS 0.4%