Moodle Project vulnerabilities

CVEs per yearBy the year they were published

1. 20259
2. 20264

Newest CVEs

• CVE-2026-119556

  Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

  Moodle Project · moodle

  Medium5.3
• CVE-2026-119555

  Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback

  Moodle Project · moodle

  Medium5.3
• CVE-2026-119554

  Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber

  Moodle Project · moodle

  Medium6.0
• CVE-2026-119553

  Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal

  Moodle Project · moodle

  High7.1
• CVE-2025-26533

  SQL injection risk in course search module list filter

  Moodle Project · moodle

  High8.1
• CVE-2025-26532

  Teachers can evade trusttext config when restoring glossary entries

  Moodle Project · moodle

  Low3.1
• CVE-2025-26531

  IDOR in badges allows disabling of arbitrary badges

  Moodle Project · moodle

  Low3.1
• CVE-2025-26530

  Reflected XSS via question bank filter

  Moodle Project · moodle

  High8.3
• CVE-2025-26529

  Stored XSS risk in admin live log

  Moodle Project · moodle

  High8.3
• CVE-2025-26528

  Stored XSS in ddimageortext question type

  Moodle Project · moodle

  Low3.4