PatchFirst · Latest vulnerabilities
Vulnerabilities published for moodle in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 323
A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.
In Moodle 3.x, there is XSS via a calendar event name.
In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.
In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.
Moodle 3.x has Server Side Request Forgery in the filepicker.
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.
In Moodle 3.x, course creators are able to change system default settings for courses.
In Moodle 3.3, the course overview block reveals activities in hidden courses.
Moodle 3.x has user fullname disclosure on the user preferences page.
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.
In Moodle 3.x, there is XSS in the assignment submission page.
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
Check your installed stack and versions against the current vulnerability feeds.