Exposição de Moodle

LMS
114
score de exposição
12.059
sites usam
0
em exploração
8
críticos
Análise Vexday

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

313 resultados
CVE-2024-43429MEDIUMMoodle: user information visibility control issues in gradebook reportsEPSS 0.3%CVE-2025-3644MEDIUMMoodle: ajax section delete does not respect course_can_delete_section()EPSS 0.3%CVE-2025-26526MEDIUMFeedback response viewing and deletions did not respect Separate Groups modeEPSS 0.3%CVE-2024-43430MEDIUMMoodle: lack of access control when using external methods for quiz overridesEPSS 0.3%CVE-2024-43433MEDIUMMoodle: matrix user/power level management not always working as expected with suspended usersEPSS 0.3%CVE-2025-3647MEDIUMMoodle: idor when accessing the cohorts reportEPSS 0.3%CVE-2025-32045MEDIUMMoodle: hidden grades shown to users without permission on some grade reportsEPSS 0.3%CVE-2023-5548LOWMoodle: cache poisoning risk with endpoint revision numbersEPSS 0.3%CVE-2024-48899MEDIUMMoodle: idor when accessing list of course badgesEPSS 0.3%CVE-2022-50943MEDIUMMoodle LMS 4.0 Cross-Site Scripting via course search.phpEPSS 0.3%CVE-2025-67850HIGHMoodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editorEPSS 0.3%CVE-2025-67856MEDIUMMoodle: moodle: privilege escalation via incomplete role checks in badge awardingEPSS 0.3%CVE-2025-62396MEDIUMMoodle: router (r.php) could expose application directoriesEPSS 0.3%CVE-2025-26531LOWIDOR in badges allows disabling of arbitrary badgesEPSS 0.3%CVE-2026-102578MEDIUMMoodle: sql injection in question bank web serviceEPSS 0.3%CVE-2025-3638HIGHMoodle: csrf risk in brickfield tool's analysis request actionEPSS 0.3%CVE-2024-48897MEDIUMMoodle: idor in edit/delete rss feedEPSS 0.3%CVE-2024-48898MEDIUMMoodle: some users can delete audiences of other reportsEPSS 0.3%CVE-2025-26528LOWStored XSS in ddimageortext question typeEPSS 0.3%CVE-2024-48901MEDIUMMoodle: idor when fetching report schedulesEPSS 0.3%