Exposição de Moodle

LMS
114
score de exposição
12.059
sites usam
0
em exploração
8
críticos
Análise Vexday

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

313 resultados
CVE-2026-26047MEDIUMMoodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of serviceEPSS 0.5%CVE-2021-36400MEDIUMIn Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.EPSS 0.5%CVE-2024-25982MEDIUMMsa-24-0005: csrf risk in language import utilityEPSS 0.5%CVE-2024-34000MEDIUMmoodle: stored XSS in lesson overview report via user ID numberEPSS 0.5%CVE-2024-34002MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupEPSS 0.5%CVE-2024-34005MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupEPSS 0.5%CVE-2023-5542LOWMoodle: students can view other users in "only see own membership" groupsEPSS 0.5%CVE-2024-43431HIGHMoodle: idor in badges allows deletion of arbitrary badgesEPSS 0.5%CVE-2022-2986—Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.EPSS 0.5%CVE-2025-67853HIGHMoodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email serviceEPSS 0.5%CVE-2024-34004MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupEPSS 0.5%CVE-2024-38276HIGHmoodle: CSRF risks due to misuse of confirm_sesskeyEPSS 0.5%CVE-2024-38275HIGHmoodle: HTTP authorization header is preserved between "emulated redirects"EPSS 0.4%CVE-2025-26525HIGHArbitrary file read risk through pdfTeXEPSS 0.4%CVE-2021-4399MEDIUMEdwiser Bridge <= 2.0.6 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2022-45149MEDIUMA vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's EPSS 0.4%CVE-2024-38273MEDIUMmoodle: BigBlueButton web service leaks meeting joining information to users who should not have accessEPSS 0.4%CVE-2026-113607HIGHConfigurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_dataEPSS 0.4%CVE-2024-34009HIGHmoodle: ReCAPTCHA can be bypassed on the login pageEPSS 0.4%CVE-2022-39183MEDIUMMoodle Plugin - SAML Auth Open RedirectEPSS 0.4%