Exposição de Moodle

LMS
114
score de exposição
12.059
sites usam
0
em exploração
8
críticos
Análise Vexday

Com 292 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Moodle apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em ambiente real. No entanto, o EPSS elevado de 0,83 associado à CVE-2024-43425 indica probabilidade estatisticamente alta de exploração para essa vulnerabilidade específica, merecendo atenção prioritária nas equipes de patch management. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web com alto volume de conteúdo gerado por usuários, e as 7 CVEs de severidade crítica reforçam a necessidade de manter ciclos de atualização regulares. A baixa atividade no KEV não deve ser interpretada como ausência de risco, especialmente diante de scores EPSS elevados que sinalizam vulnerabilidades com perfil de interesse por parte de agentes maliciosos.

CVEs

313 resultados
CVE-2023-5551LOWMoodle: forum summary report shows students from other groups when in separate groups modeEPSS 0.3%CVE-2025-67851MEDIUMMoodle: moodle: formula injection allows arbitrary formula execution via unescaped data exportEPSS 0.3%CVE-2026-119556MEDIUMMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitemsEPSS 0.3%CVE-2025-62397MEDIUMMoodle: router produces json instead of 404 error for invalid course idEPSS 0.3%CVE-2026-102586MEDIUMMoodle: xss via password reset link due to insufficient username escapingEPSS 0.3%CVE-2025-62400MEDIUMMoodle: hidden group names visible to event creatorsEPSS 0.3%CVE-2025-3634MEDIUMMoodle: moodle allows course self-enrolment before completing mfaEPSS 0.3%CVE-2025-26532LOWTeachers can evade trusttext config when restoring glossary entriesEPSS 0.3%CVE-2025-67849HIGHMoodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responsesEPSS 0.3%CVE-2025-67852LOWMoodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.EPSS 0.3%CVE-2023-5543LOWMoodle: duplicating a bigbluebutton activity assigns the same meeting idEPSS 0.3%CVE-2025-62395MEDIUMMoodle: external cohort search service leaks system cohort dataEPSS 0.2%CVE-2025-62398MEDIUMMoodle: possible to bypass mfaEPSS 0.2%CVE-2026-102577MEDIUMMoodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypassEPSS 0.2%CVE-2024-38277MEDIUMmoodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keysEPSS 0.2%CVE-2025-62393MEDIUMMoodle: course access permissions not properly checked in course_output_fragment_course_overviewEPSS 0.2%CVE-2026-102583LOWMoodle: incorrect capability check in ai generate image web serviceEPSS 0.2%CVE-2026-102587LOWMoodle: user list filters bypass profile field visibilityEPSS 0.2%CVE-2026-102580LOWMoodle: arbitrary class instantiation via report builder audience classnameEPSS 0.2%CVE-2025-62394MEDIUMMoodle: quiz notifications sent to suspended participantsEPSS 0.2%