MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102578 | 8.8 | Sep 30 | Moodle: sql injection in question bank web service Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2 |
| CVE-2025-67847 | 8.8 | Jan 23 | Moodle: moodle: remote code execution via insufficient restore input validation Affected: before 4.1.22; 4.4.0 before 4.4.12; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-3642 | 8.8 | Apr 25 | Moodle: authenticated remote code execution risk in the moodle lms equella repository Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3641 | 8.8 | Apr 25 | Moodle: authenticated remote code execution risk in the moodle lms dropbox repository Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2025-3638 | 8.8 | Apr 25 | Moodle: csrf risk in brickfield tool's analysis request action Affected: before 4.1.18; 4.3.0 before 4.3.12; 4.4.0 before 4.4.8; 4.5.0 before 4.5.4 |
| CVE-2024-38276 | 8.8 | Jun 18 | moodle: CSRF risks due to misuse of confirm_sesskey Affected: 4.4; 4.3 through 4.3.4; 4.2 through 4.2.7; 4.1 through 4.1.10 |
| CVE-2024-34008 | 8.8 | May 31 | moodle: CSRF risk in analytics management of models Affected: 4.0 before 4.3.4; 4.1 before 4.1.10; 4.2 before 4.2.7 |
| CVE-2024-34007 | 8.8 | May 31 | moodle: logout CSRF in admin/tool/mfa/auth.php Affected: 4.3.0 before 4.3.4 |
| CVE-2024-25982 | 8.8 | Feb 19 | Msa-24-0005: csrf risk in language import utility Affected: 4.1.0 before 4.1.9; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3 |
| CVE-2023-5540 | 8.8 | Nov 9 | Moodle: authenticated remote code execution risk in imscp Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-5539 | 8.8 | Nov 9 | Moodle: authenticated remote code execution risk in lesson Affected: before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3 |
| CVE-2023-28329 | 8.8 | Mar 23 | Moodle: authenticated sql injection via availability check Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more |
| CVE-2023-28335 | 8.8 | Mar 23 | Moodle: csrf risk in resetting all templates of a database activity Affected: 4.1.0; 4.1.1 |
| CVE-2022-2986 | 8.8 | Oct 6 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk Affected: 3.11.0 before 3.11.9; 4.0.0 before 4.0.3 |
| CVE-2020-14321 | 8.8 | Aug 16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course Affected: 3.5.0 before 3.5.13; 3.7.0 before 3.7.7; 3.8.0 before 3.8.4; 3.9.0 |
| CVE-2022-0983 | 8.8 | Mar 25 | An SQL injection risk was identified in Badges code relating to configuring criteria Affected: 3.9.0 before 3.9.13; 3.10.0 before 3.10.10; 3.11.0 before 3.11.6 |
| CVE-2022-0335 | 8.8 | Jan 25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions Affected: through 3.8.9; 3.9.0 before 3.9.12; 3.10.0 before 3.10.9; 3.11.0 before 3.11.5 |
| CVE-2021-43559 | 8.8 | Nov 22 | A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions Affected: through 3.8.8; 3.9.0 before 3.9.11; 3.10.0 before 3.10.8; 3.11.0 before 3.11.4 |
| CVE-2020-25629 | 8.8 | Dec 8 | A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration… Affected: 3.5.0 before 3.5.14; 3.7.0 before 3.7.8; 3.8.0 before 3.8.5; 3.9.0 before 3.9.2 |
| CVE-2020-10738 | 8.8 | May 21 | A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions Affected: 3.5 before 3.5.12; 3.6 before 3.6.10; 3.7 before 3.7.6; 3.8 before 3.8.3 |
| CVE-2019-10186 | 8.8 | Jul 31 | A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7 Affected: before 3.5.7; 3.6.0 before 3.6.5; 3.7.0 before 3.7.1 |
| CVE-2019-3849 | 8.8 | Mar 26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8 Affected: before 3.4.8; 3.5.0 before 3.5.5; 3.6.0 before 3.6.3 |
| CVE-2018-16854 | 8.8 | Nov 26 | A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier Affected: through 3.0.10; 3.1.0 before 3.1.15; 3.3.0 before 3.3.9; 3.4.0 before 3.4.6; 3.5.0 before 3.5.3 |
| CVE-2018-14630 | 8.8 | Sep 17 | moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution Affected: through 3.0.10; 3.1.0 before 3.1.14; 3.3.0 before 3.3.8; 3.4.0 before 3.4.5; 3.5.0 before 3.5.2 |
| CVE-2018-1133 | 8.8 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2016-3734 | 8.8 | Apr 20 | Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote… Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more |
| CVE-2016-9187 | 8.8 | Nov 4 | Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by… Affected: through 3.1.2 |
| CVE-2016-9186 | 8.8 | Nov 4 | Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by… Affected: through 3.1.2 |
| CVE-2016-2157 | 8.8 | May 22 | Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more |
| CVE-2015-5338 | 8.8 | Feb 22 | Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow… Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +18 more |
| CVE-2025-26525 | 8.6 | Feb 24 | Arbitrary file read risk through pdfTeX Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2 |
| CVE-2024-34001 | 8.4 | May 31 | moodle: CSRF risk in admin preset tool management of presets Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4 |
| CVE-2023-23923 | 8.2 | Feb 17 | Moodle: possible to set the preferred "start page" of other users Affected: 3.9.0 before 3.9.19; 3.11.0 before 3.11.12; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2012-1168 | 8.2 | Nov 14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified Affected: before 2.2.2 |
| CVE-2025-67848 | 8.1 | Feb 3 | Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access. Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2024-43434 | 8.1 | Nov 7 | Moodle: csrf risk in feedback non-respondents report Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43425 | 8.1 | Nov 7 | Moodle: remote code execution via calculated question types Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2018-1137 | 8.1 | May 25 | An issue was discovered in Moodle 3.x Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2 |
| CVE-2018-1082 | 8.1 | Apr 4 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4 Affected: 3.3.0 through 3.3.4; 3.4.0 through 3.4.1 |
| CVE-2025-67851 | 7.8 | Feb 3 | Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-67853 | 7.5 | Feb 3 | Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0 |
| CVE-2025-62399 | 7.5 | Oct 23 | Moodle: password brute force risk when mobile/web services enabled Affected: 4.1.0 before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3 |
| CVE-2025-32044 | 7.5 | Apr 25 | Moodle: unauthenticated rest api user data exposure Affected: 4.5.0 before 4.5.3 |
| CVE-2024-45690 | 7.5 | Nov 20 | Moodle: idor when deleting oauth2 linked accounts Affected: before 4.1.13; 4.2.0 before 4.2.10; 4.3.0 before 4.3.7; 4.4.0 before 4.4.3 |
| CVE-2024-43440 | 7.5 | Nov 7 | Moodle: lfi vulnerability when restoring malformed block backups Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43438 | 7.5 | Nov 7 | Moodle: idor in feedback non-respondents report allows messaging arbitrary site users Affected: 4.1.0 before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43431 | 7.5 | Nov 7 | Moodle: idor in badges allows deletion of arbitrary badges Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-43426 | 7.5 | Nov 7 | Moodle: arbitrary file read risk through pdftex Affected: 4.1.0 before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2 |
| CVE-2024-38275 | 7.5 | Jun 18 | moodle: HTTP authorization header is preserved between "emulated redirects" Affected: 4.4; 4.3 through 4.3.4; 4.2 through 4.2.7; 4.1 through 4.1.10 |
| CVE-2024-34009 | 7.5 | May 31 | moodle: ReCAPTCHA can be bypassed on the login page Affected: 4.3.0 before 4.3.4 |
The 500 most important CVEs for this product (exploited first, then by severity)