Exposição de Moodle

LMS
114
score de exposição
12.059
sites usam
0
em exploração
8
críticos
Análise Vexday

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

313 resultados
CVE-2025-26527MEDIUMNon-searchable tags can still be discovered on the tag search page and in the tags blockEPSS 0.4%CVE-2025-3645MEDIUMMoodle: idor in messaging web service allows access to some user detailsEPSS 0.4%CVE-2025-26530HIGHReflected XSS via question bank filterEPSS 0.4%CVE-2024-45690HIGHMoodle: idor when deleting oauth2 linked accountsEPSS 0.4%CVE-2026-113683MEDIUMVPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filenameEPSS 0.4%CVE-2024-34003MEDIUMmoodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backupEPSS 0.4%CVE-2025-67857MEDIUMMoodle: moodle: data exposure of user identifiers in urlsEPSS 0.4%CVE-2024-34007HIGHmoodle: logout CSRF in admin/tool/mfa/auth.phpEPSS 0.4%CVE-2024-34006MEDIUMmoodle: unsanitized HTML in site log for config_log_createdEPSS 0.4%CVE-2024-43439MEDIUMMoodle: reflected xss via h5p error messageEPSS 0.4%CVE-2024-48900MEDIUMMoodle: idor when accessing list of badge recipientsEPSS 0.4%CVE-2024-43435MEDIUMMoodle: can create global glossary without being adminEPSS 0.3%CVE-2025-3643MEDIUMMoodle: reflected xss risk in policy toolEPSS 0.3%CVE-2020-36633MEDIUMmoodle-block_sitenews block_sitenews.php get_content cross-site request forgeryEPSS 0.3%CVE-2025-3627MEDIUMMoodle: partial data exposure in moodle before completing multi-factor authenticationEPSS 0.3%CVE-2024-43427LOWMoodle: admin presets export tool includes some secrets that should not be exportedEPSS 0.3%CVE-2025-3636MEDIUMMoodle: idor in moodle rss block allows unauthorized access to rss feedsEPSS 0.3%CVE-2025-3628MEDIUMMoodle: moodle assignment submission search leaks anonymous student identitiesEPSS 0.3%CVE-2024-43437MEDIUMMoodle: xss risk when restoring malicious course backup fileEPSS 0.3%CVE-2024-43432MEDIUMMoodle: authorization headers preserved between "emulated redirects"EPSS 0.3%