Exposição de Moodle

LMS
114
score de exposição
12.059
sites usam
0
em exploração
8
críticos
Análise Vexday

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

313 resultados
CVE-2026-119553HIGHMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path TraversalEPSS 0.4%CVE-2025-3625HIGHMoodle: user dos and name disclosure via idor in moodle mfa email factor revoke actionEPSS 0.4%CVE-2025-67848HIGHMoodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.EPSS 0.4%CVE-2024-45691MEDIUMMoodle: lesson activity password bypass through php loose comparisonEPSS 0.4%CVE-2023-28335HIGHMoodle: csrf risk in resetting all templates of a database activityEPSS 0.4%CVE-2025-62399HIGHMoodle: password brute force risk when mobile/web services enabledEPSS 0.4%CVE-2024-34001HIGHmoodle: CSRF risk in admin preset tool management of presetsEPSS 0.4%CVE-2024-34008LOWmoodle: CSRF risk in analytics management of modelsEPSS 0.4%CVE-2024-45689MEDIUMMoodle: unprotected access to sensitive information via dynamic tablesEPSS 0.4%CVE-2026-113608MEDIUMConfigurable Reports block for Moodle before 5.3.1 SQL Injection via filter_varEPSS 0.4%CVE-2025-3640MEDIUMMoodle: idor in web service allows users enrolled in a course to access some details of other usersEPSS 0.4%CVE-2025-67855MEDIUMMooodle: mooodle: information disclosure and script execution via reflected cross-site scriptingEPSS 0.4%CVE-2024-33997MEDIUMmoodle: stored XSS risk when editing another user's equation in equation editorEPSS 0.4%CVE-2024-38274MEDIUMmoodle: stored XSS via calendar's event title when deleting the eventEPSS 0.4%CVE-2021-47857MEDIUMMoodle 3.10.3 - 'label' Persistent Cross Site ScriptingEPSS 0.4%CVE-2024-48896MEDIUMMoodle: users' names returned in messaging error messageEPSS 0.4%CVE-2024-33996MEDIUMmoodle: broken access control when setting calendar event typeEPSS 0.4%CVE-2024-33998MEDIUMmoodle: stored XSS via user's name on participants page when opening some optionsEPSS 0.4%CVE-2025-53021MEDIUMA session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey paraEPSS 0.4%CVE-2025-3637LOWMoodle: csrf token exposure via url in moodle mod_data moduleEPSS 0.4%