Moodle Moodle vulnerabilities

CVEs per yearBy the year they were published

1. 201913
2. 20246
3. 20251
4. 20261

Newest CVEs

• CVE-2021-47857

  Moodle 3.10.3 - 'label' Persistent Cross Site Scripting

  Moodle · Moodle

  Medium5.1
• CVE-2025-53021

  A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey…

  Moodle · Moodle

  Medium4.2
• CVE-2024-38277

  moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys

  Moodle · Moodle

  Medium5.4
• CVE-2024-38276

  moodle: CSRF risks due to misuse of confirm_sesskey

  Moodle · Moodle

  High8.8
• CVE-2024-38275

  moodle: HTTP authorization header is preserved between "emulated redirects"

  Moodle · Moodle

  High7.5
• CVE-2024-38274

  moodle: stored XSS via calendar's event title when deleting the event

  Moodle · Moodle

  Medium6.1
• CVE-2024-38273

  moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

  Moodle · Moodle

  Medium5.4
• CVE-2024-33996

  moodle: broken access control when setting calendar event type

  Moodle · Moodle

  Medium6.2
• CVE-2012-1161

  Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results

  Moodle · Moodle

  Medium4.3
• CVE-2012-1170

  Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough

  Moodle · Moodle

  High7.5