Skip to content
Noroxi

Moodle records

643 published records for vendor moodle.

Researcher profile

Entered KEV
0 · 0%
Weaponized
5 · 0.8%
Pre-auth RCE
27
With a fix record
75.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

643 records
  • CVE-2024-43425
    60This week

    Moodle: remote code execution via calculated question types

    HighCVSS 8.1WeaponizedEPSS 87%

    moodle · moodleNov 7, 2024

  • CVE-2021-36393
    55Plan

    In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    moodle · moodleMar 6, 2023

  • CVE-2022-0332
    52Plan

    A flaw was found in Moodle in versions 3.11 to 3.11.4.

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    moodle · moodleJan 25, 2022

  • CVE-2022-35650
    46Plan

    The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions.

    HighCVSS 7.5Proof of conceptEPSS 53%

    moodle · moodleJul 25, 2022

  • CVE-2018-1133
    44Plan

    An issue was discovered in Moodle 3.x.

    HighCVSS 8.8Proof of conceptEPSS 31%

    moodle · moodleMay 25, 2018

  • CVE-2021-21809
    43Plan

    A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10.

    CriticalCVSS 9.1WeaponizedEPSS 24%

    moodle · moodleJun 23, 2021

  • CVE-2017-2641
    43Plan

    In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    moodle · moodleMar 26, 2017

  • CVE-2022-35649
    42Plan

    The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code.

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    moodle · moodleJul 25, 2022

  • CVE-2021-36394
    41Plan

    In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    moodle · moodleMar 6, 2023

  • CVE-2004-2233
    41Plan

    Unknown "front page vulnerability with Moodle servers" for Moodle before 1.3.2 has unknown impact and attack vectors.

    CriticalCVSS 10.0No exploitEPSS 1%

    moodle · moodleDec 31, 2004

  • CVE-2004-2237
    41Plan

    Unknown vulnerability in Moodle before 1.3.4 has unknown impact and attack vectors, related to "strings in Moodle texts."

    CriticalCVSS 10.0No exploitEPSS 1%

    moodle · moodleDec 31, 2004

  • CVE-2013-3630
    40Plan

    Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then tr

    MediumCVSS 4.6WeaponizedEPSS 41%

    moodle · moodleOct 31, 2013

  • CVE-2013-4341
    40Plan

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2

    MediumCVSS 4.3WeaponizedEPSS 21%

    moodle · moodleSep 16, 2013

  • CVE-2020-14321
    40Plan

    In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

    HighCVSS 8.8WeaponizedEPSS 16%

    moodle · moodleAug 16, 2022

  • CVE-2022-30600
    40Plan

    A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    moodle · moodleMay 18, 2022

  • CVE-2021-3943
    40Plan

    A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions.

    CriticalCVSS 9.8No exploitEPSS 2%

    moodle · moodleNov 22, 2021

  • CVE-2022-40314
    40Plan

    A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.

    CriticalCVSS 9.8No exploitEPSS 2%

    moodle · moodleSep 30, 2022

  • CVE-2005-2247
    40Plan

    Multiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors.

    CriticalCVSS 10.0No exploitEPSS 1%

    moodle · moodleJul 12, 2005

  • CVE-2006-4936
    40Plan

    Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and

    CriticalCVSS 10.0No exploitEPSS 1%

    moodle · moodleSep 22, 2006

  • CVE-2006-4935
    40Plan

    The Database module in Moodle before 1.6.2 does not properly handle uploaded files, which has unspecified impact and remote attack vectors.

    CriticalCVSS 10.0No exploitEPSS 1%

    moodle · moodleSep 22, 2006

  • CVE-2004-2236
    40Plan

    Unknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting.

    CriticalCVSS 10.0No exploitEPSS 1%

    moodle · moodleDec 31, 2004

  • CVE-2004-2235
    40Plan

    Unknown vulnerability in Moodle before 1.2 has unknown impact and attack vectors, related to improper filtering of text.

    CriticalCVSS 10.0No exploitEPSS 1%

    moodle · moodleDec 31, 2004

  • CVE-2019-3809
    40Plan

    A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions.

    CriticalCVSS 10.0No exploitEPSS 0%

    moodle · moodleMar 25, 2019

  • CVE-2023-5550
    39Monitor

    Moodle: rce due to lfi risk in some misconfigured shared hosting environments

    CriticalCVSS 9.8No exploitEPSS 1%

    moodle · moodleNov 9, 2023

  • CVE-2022-30599
    39Monitor

    A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.

    CriticalCVSS 9.8No exploitEPSS 1%

    moodle · moodleMay 18, 2022