Exposición de Moodle

LMS
74
score de exposición
10.577
sitios usan
0
en explotación
8
críticos
Análisis Vexday

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

293 resultados
CVE-2022-39183MEDIUMMoodle Plugin - SAML Auth Open RedirectEPSS 0.4%CVE-2025-3625HIGHMoodle: user dos and name disclosure via idor in moodle mfa email factor revoke actionEPSS 0.4%CVE-2024-34001HIGHmoodle: CSRF risk in admin preset tool management of presetsEPSS 0.4%CVE-2024-45689MEDIUMMoodle: unprotected access to sensitive information via dynamic tablesEPSS 0.4%CVE-2025-67848HIGHMoodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.EPSS 0.4%CVE-2024-34008LOWmoodle: CSRF risk in analytics management of modelsEPSS 0.4%CVE-2025-3640MEDIUMMoodle: idor in web service allows users enrolled in a course to access some details of other usersEPSS 0.4%CVE-2025-62399HIGHMoodle: password brute force risk when mobile/web services enabledEPSS 0.4%CVE-2024-48896MEDIUMMoodle: users' names returned in messaging error messageEPSS 0.4%CVE-2024-38274MEDIUMmoodle: stored XSS via calendar's event title when deleting the eventEPSS 0.4%CVE-2024-33997MEDIUMmoodle: stored XSS risk when editing another user's equation in equation editorEPSS 0.4%CVE-2024-33996MEDIUMmoodle: broken access control when setting calendar event typeEPSS 0.4%CVE-2021-47857MEDIUMMoodle 3.10.3 - 'label' Persistent Cross Site ScriptingEPSS 0.4%CVE-2024-43439MEDIUMMoodle: reflected xss via h5p error messageEPSS 0.4%CVE-2024-33998MEDIUMmoodle: stored XSS via user's name on participants page when opening some optionsEPSS 0.4%CVE-2024-45690HIGHMoodle: idor when deleting oauth2 linked accountsEPSS 0.4%CVE-2025-26527MEDIUMNon-searchable tags can still be discovered on the tag search page and in the tags blockEPSS 0.4%CVE-2025-26530HIGHReflected XSS via question bank filterEPSS 0.4%CVE-2025-3637LOWMoodle: csrf token exposure via url in moodle mod_data moduleEPSS 0.4%CVE-2025-3645MEDIUMMoodle: idor in messaging web service allows access to some user detailsEPSS 0.4%