MO
Vendor
Moodle
644
CVEs
0
On KEV
12
New 30D
Products
MO10.0
Moodle
Moodle
637 CVEs0 on KEV12 new
JP7.5
Jmol Plugin
Moodle
2 CVEs0 on KEV0 new
H55.3
H5p
Moodle
1 CVEs0 on KEV0 new
LM3.3
LMS
Moodle
1 CVEs0 on KEV0 new
ML6.1
Moodle LMS
Moodle
1 CVEs0 on KEV0 new
SA6.1
Saml Authentication
Moodle
1 CVEs0 on KEV0 new
VP6.1
Virtual Programming Lab
Moodle
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102588 | MO Moodle Moodle | 6.5 | Sep 30 | Moodle: csrf in xml grade import |
| CVE-2026-102587 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: user list filters bypass profile field visibility |
| CVE-2026-102586 | MO Moodle Moodle | 6.1 | Sep 30 | Moodle: xss via password reset link due to insufficient username escaping |
| CVE-2026-102585 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: group validation missing when enrolling user to course |
| CVE-2026-102584 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: missing capability check allows unauthorised grade penalty recalculation |
| CVE-2026-102583 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: incorrect capability check in ai generate image web service |
| CVE-2026-102582 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: manual enrolment page accessible when plugin disabled |
| CVE-2026-102581 | MO Moodle Moodle | 5.4 | Sep 30 | Moodle: xss in forum post templates due to insufficient escaping |
| CVE-2026-102580 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: arbitrary class instantiation via report builder audience classname |
| CVE-2026-102579 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: user profile information disclosure via grade web service |
| CVE-2026-102578 | MO Moodle Moodle | 8.8 | Sep 30 | Moodle: sql injection in question bank web service |
| CVE-2026-102577 | MO Moodle Moodle | 4.3 | Sep 30 | Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass |
| CVE-2022-50943 | ML Moodle LMS Moodle | 6.1 | May 10 | Moodle LMS 4.0 Cross-Site Scripting via course search.php |
| CVE-2026-26047 | MO Moodle Moodle | 6.5 | Feb 21 | Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service |
| CVE-2026-26046 | MO Moodle Moodle | 7.2 | Feb 21 | Moodle: moodle: improper input sanitization in tex filter administration setting |
| CVE-2026-26045 | MO Moodle Moodle | 7.2 | Feb 21 | Moodle: moodle: improper validation in file restore functionality leading to remote code execution |
| CVE-2025-67857 | MO Moodle Moodle | 5.3 | Feb 3 | Moodle: moodle: data exposure of user identifiers in urls |
| CVE-2025-67856 | MO Moodle Moodle | 9.8 | Feb 3 | Moodle: moodle: privilege escalation via incomplete role checks in badge awarding |
| CVE-2025-67855 | MO Moodle Moodle | 6.1 | Feb 3 | Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting |
| CVE-2025-67853 | MO Moodle Moodle | 7.5 | Feb 3 | Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service |
| CVE-2025-67852 | MO Moodle Moodle | 6.1 | Feb 3 | Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites. |
| CVE-2025-67851 | MO Moodle Moodle | 7.8 | Feb 3 | Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export |
| CVE-2025-67850 | MO Moodle Moodle | 6.1 | Feb 3 | Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor |
| CVE-2025-67849 | MO Moodle Moodle | 6.1 | Feb 3 | Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses |
| CVE-2025-67848 | MO Moodle Moodle | 8.1 | Feb 3 | Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access. |
| CVE-2025-67847 | MO Moodle Moodle | 8.8 | Jan 23 | Moodle: moodle: remote code execution via insufficient restore input validation |
| CVE-2021-47857 | MO Moodle Moodle | 6.1 | Jan 21 | Moodle 3.10.3 - 'label' Persistent Cross Site Scripting |
| CVE-2025-62401 | MO Moodle Moodle | 4.3 | Oct 23 | Moodle: possible to bypass timer in timed assignments |
| CVE-2025-62395 | MO Moodle Moodle | 4.3 | Oct 23 | Moodle: external cohort search service leaks system cohort data |
| CVE-2025-62400 | MO Moodle Moodle | 6.5 | Oct 23 | Moodle: hidden group names visible to event creators |
| CVE-2025-62399 | MO Moodle Moodle | 7.5 | Oct 23 | Moodle: password brute force risk when mobile/web services enabled |
| CVE-2025-62398 | MO Moodle Moodle | 5.4 | Oct 23 | Moodle: possible to bypass mfa |
| CVE-2025-62397 | MO Moodle Moodle | 5.3 | Oct 23 | Moodle: router produces json instead of 404 error for invalid course id |
| CVE-2025-62396 | MO Moodle Moodle | 5.3 | Oct 23 | Moodle: router (r.php) could expose application directories |
| CVE-2025-62394 | MO Moodle Moodle | 4.3 | Oct 23 | Moodle: quiz notifications sent to suspended participants |
| CVE-2025-62393 | MO Moodle Moodle | 4.3 | Oct 23 | Moodle: course access permissions not properly checked in course_output_fragment_course_overview |
| CVE-2025-34032 | JP Jmol Plugin Moodle | 6.1 | Jun 24 | Moodle LMS Jmol Plugin Cross-site Scripting (XSS) |
| CVE-2025-34031 | JP Jmol Plugin Moodle | 7.5 | Jun 24 | Moodle LMS Jmol Plugin Path Traversal |
| CVE-2025-53021 | MO Moodle Moodle | 4.2 | Jun 24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter |
| CVE-2025-32045 | MO Moodle Moodle | 5.3 | Apr 25 | Moodle: hidden grades shown to users without permission on some grade reports |
| CVE-2025-32044 | MO Moodle Moodle | 7.5 | Apr 25 | Moodle: unauthenticated rest api user data exposure |
| CVE-2025-3647 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: idor when accessing the cohorts report |
| CVE-2025-3645 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: idor in messaging web service allows access to some user details |
| CVE-2025-3644 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: ajax section delete does not respect course_can_delete_section() |
| CVE-2025-3643 | MO Moodle Moodle | 5.4 | Apr 25 | Moodle: reflected xss risk in policy tool |
| CVE-2025-3642 | MO Moodle Moodle | 8.8 | Apr 25 | Moodle: authenticated remote code execution risk in the moodle lms equella repository |
| CVE-2025-3641 | MO Moodle Moodle | 8.8 | Apr 25 | Moodle: authenticated remote code execution risk in the moodle lms dropbox repository |
| CVE-2025-3640 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: idor in web service allows users enrolled in a course to access some details of other users |
| CVE-2025-3638 | MO Moodle Moodle | 8.8 | Apr 25 | Moodle: csrf risk in brickfield tool's analysis request action |
| CVE-2025-3637 | MO Moodle Moodle | 3.1 | Apr 25 | Moodle: csrf token exposure via url in moodle mod_data module |
| CVE-2025-3636 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: idor in moodle rss block allows unauthorized access to rss feeds |
| CVE-2025-3635 | MO Moodle Moodle | 3.5 | Apr 25 | Moodle: csrf risk in moodle user tours manager allows tour duplication |
| CVE-2025-3628 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: moodle assignment submission search leaks anonymous student identities |
| CVE-2025-3627 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: partial data exposure in moodle before completing multi-factor authentication |
| CVE-2025-3625 | MO Moodle Moodle | 7.1 | Apr 25 | Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action |
| CVE-2025-3634 | MO Moodle Moodle | 4.3 | Apr 25 | Moodle: moodle allows course self-enrolment before completing mfa |
| CVE-2025-26533 | MO Moodle Moodle | 9.8 | Feb 24 | SQL injection risk in course search module list filter |
| CVE-2025-26532 | MO Moodle Moodle | 4.3 | Feb 24 | Teachers can evade trusttext config when restoring glossary entries |
| CVE-2025-26531 | MO Moodle Moodle | 5.3 | Feb 24 | IDOR in badges allows disabling of arbitrary badges |
| CVE-2025-26530 | MO Moodle Moodle | 6.1 | Feb 24 | Reflected XSS via question bank filter |