Login Request a demo
MO
Product
Moodle
by Moodle · last CVE Sep 30, 2026
637
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities637In the news0Timeline
Severity mix
Critical 20High 80Medium 247Low 11
Severity
All severities500Critical20High80Medium247Low11
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Moodle to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2015-5332
6.8
2%
Feb 22
Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts…
Affected: 2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +6 more
CVE-2015-5266
6.8
2%
Feb 22
The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users…
Affected: through 2.6.11; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +15 more
CVE-2026-102588
6.5
0%
Sep 30
Moodle: csrf in xml grade import
Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2
CVE-2026-26047
6.5
1%
Feb 21
Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service
Affected: before 4.5.9; 5.0.0 before 5.0.5; 5.1.0 before 5.1.2
CVE-2025-62400
6.5
0%
Oct 23
Moodle: hidden group names visible to event creators
Affected: 4.1.0 before 4.1.21; 4.4.0 before 4.4.11; 4.5.0 before 4.5.7; 5.0.0 before 5.0.3
CVE-2025-26526
6.5
0%
Feb 24
Feedback response viewing and deletions did not respect Separate Groups mode
Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2
CVE-2024-45689
6.5
0%
Nov 20
Moodle: unprotected access to sensitive information via dynamic tables
Affected: before 4.1.13; 4.2.0 before 4.2.10; 4.3.0 before 4.3.7; 4.4.0 before 4.4.3
CVE-2024-34005
6.5
0%
May 31
moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup
Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4
CVE-2024-34004
6.5
0%
May 31
moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup
Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4
CVE-2024-34002
6.5
0%
May 31
moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup
Affected: before 4.1.10; 4.2.0 before 4.2.7; after 4.3.0 before 4.3.4
CVE-2023-28330
6.5
1%
Mar 23
Moodle: authenticated arbitrary file read through malformed backup file
Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more
CVE-2021-40693
6.5
1%
Jan 21
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability
Affected: before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.3
CVE-2020-25700
6.5
1%
Nov 19
In moodle, some database module web services allowed students to add entries within groups they did not belong to
Affected: 3.5.0 through 3.5.14; 3.7.0 through 3.7.8; 3.8.0 through 3.8.5; 3.9.0 through 3.9.2
CVE-2020-1692
6.5
1%
Feb 17
Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course
Affected: before 3.7.2
CVE-2018-1135
6.5
1%
May 25
An issue was discovered in Moodle 3.x
Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2
CVE-2018-1134
6.5
1%
May 25
An issue was discovered in Moodle 3.x
Affected: 3.1.0 through 3.1.11; 3.2.0 through 3.2.8; 3.3.0 through 3.3.5; 3.4.0 through 3.4.2
CVE-2018-1043
6.5
1%
Jan 22
In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames
Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +6 more
CVE-2018-1042
6.5
16%
Jan 22
Moodle 3.x has Server Side Request Forgery in the filepicker
Affected: through 3.1.9; 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; +7 more
CVE-2017-7532
6.5
1%
Jul 17
In Moodle 3.x, course creators are able to change system default settings for courses
Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.1; 3.1.2; +16 more
CVE-2017-2642
6.5
1%
Jul 17
Moodle 3.x has user fullname disclosure on the user preferences page
Affected: 3.1.0; 3.1.0; 3.1.0; 3.1.0; 3.1.1; 3.1.2; +16 more
CVE-2016-3729
6.5
1%
Apr 20
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields…
Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more
CVE-2023-35132
6.3
1%
Jun 22
Moodle: minor sql injection risk on mnet sso access control page
Affected: before 3.9.22; 3.11.0 before 3.11.15; 4.0.0 before 4.0.9; 4.1.0 before 4.1.4; 4.2.0
CVE-2017-7489
6.3
1%
May 15
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link
Affected: 2.7.0; 2.7.0; 2.7.0; 2.7.0; 2.7.1; 2.7.2; +34 more
CVE-2024-33996
6.2
0%
May 31
moodle: broken access control when setting calendar event type
Affected: 4.0 through 4.3.3; 4.2 through 4.2.6; 4.1 through 4.1.9
CVE-2026-102586
6.1
0%
Sep 30
Moodle: xss via password reset link due to insufficient username escaping
Affected: before 4.5.13; 5.0.0 before 5.0.9; 5.1.0 before 5.1.6; 5.2.0 before 5.2.2
CVE-2022-50943
6.1
0%
May 10
Moodle LMS 4.0 Cross-Site Scripting via course search.php
Affected: through 4.0.0
CVE-2025-67855
6.1
0%
Feb 3
Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting
Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0
CVE-2025-67852
6.1
0%
Feb 3
Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.
Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0
CVE-2025-67850
6.1
0%
Feb 3
Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor
Affected: before 4.1.22; 4.4.0 before 4.4.11; 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0
CVE-2025-67849
6.1
0%
Feb 3
Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses
Affected: 4.5.0 before 4.5.8; 5.0.0 before 5.0.4; 5.1.0
CVE-2021-47857
6.1
0%
Jan 21
Moodle 3.10.3 - 'label' Persistent Cross Site Scripting
Affected: 3.10.3
CVE-2025-26530
6.1
0%
Feb 24
Reflected XSS via question bank filter
Affected: 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2
CVE-2025-26529
6.1
1%
Feb 24
Stored XSS risk in admin live log
Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2
CVE-2025-26528
6.1
0%
Feb 24
Stored XSS in ddimageortext question type
Affected: 4.1.0 before 4.1.16; 4.3.0 before 4.3.10; 4.4.0 before 4.4.6; 4.5.0 before 4.5.2
CVE-2024-43439
6.1
0%
Nov 11
Moodle: reflected xss via h5p error message
Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2
CVE-2024-43437
6.1
0%
Nov 11
Moodle: xss risk when restoring malicious course backup file
Affected: before 4.1.12; 4.2.0 before 4.2.9; 4.3.0 before 4.3.6; 4.4.0 before 4.4.2
CVE-2024-38274
6.1
0%
Jun 18
moodle: stored XSS via calendar's event title when deleting the event
Affected: 4.4; 4.3 through 4.3.4; 4.2 through 4.2.7; 4.1 through 4.1.10
CVE-2024-33997
6.1
0%
May 31
moodle: stored XSS risk when editing another user's equation in equation editor
Affected: before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.4
CVE-2024-29374
6.1
1%
Mar 21
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter
Affected: 3.10.9
CVE-2023-5547
6.1
1%
Nov 9
Moodle: xss risk when previewing data in course upload tool
Affected: 3.9.0 before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3
CVE-2023-5541
6.1
1%
Nov 9
Moodle: xss risk when using csv grade import method
Affected: 3.9.0 before 3.9.24; 3.11.0 before 3.11.17; 4.0.0 before 4.0.11; 4.1.0 before 4.1.6; 4.2.0 before 4.2.3
CVE-2023-35131
6.1
1%
Jun 22
Moodle: xss risk on groups page
Affected: 3.11.0 before 3.11.15; 4.0.0 before 4.0.9; 4.1.0 before 4.1.4; 4.2.0
CVE-2023-28331
6.1
1%
Mar 23
Moodle: xss risk when outputting database activity filter data
Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more
CVE-2023-28332
6.1
1%
Mar 23
Moodle: algebra filter xss when filter is misconfigured
Affected: after 3.9.0 before 3.9.20; after 3.11.0 before 3.11.13; after 4.0.0 before 4.0.7; 3.9.0; 3.11.0; 4.0.0; +2 more
CVE-2023-23922
6.1
1%
Feb 17
Moodle: reflected xss risk in blog search
Affected: 4.0.0 before 4.0.6; 4.1.0
CVE-2023-23921
6.1
1%
Feb 17
Moodle: reflected xss risk in some returnurl parameters
Affected: 3.9.0 before 3.9.19; 3.11.0 before 3.11.12; 4.0.0 before 4.0.6; 4.1.0
CVE-2022-45150
6.1
1%
Nov 23
A reflected cross-site scripting vulnerability was discovered in Moodle
Affected: 3.9.0 before 3.9.18; 3.11.0 before 3.11.11; 4.0.0 before 4.0.5
CVE-2020-14320
6.1
1%
Aug 16
In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk
Affected: 3.7.0 before 3.7.7; 3.8.0 before 3.8.4; 3.9.0
CVE-2022-35653
6.1
5%
Jul 25
A reflected XSS issue was identified in the LTI module of Moodle
Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +3 more
CVE-2022-35652
6.1
1%
Jul 25
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature
Affected: 3.9.0 before 3.9.15; 3.11.0 before 3.11.8; 4.0.0 before 4.0.2
Page 3 of 10 · 500 total
1234…10
The 500 most important CVEs for this product (exploited first, then by severity)