CVE-2026-113608

The Configurable Reports block for Moodle (moodle-block_configurablereports) versions prior to 5.3.1 is vulnerable to an SQL injection in the report_sql::prepare_sql() function. The flaw is triggered via the filter_var request parameter within viewreport.php. Low-privileged users authorized to vi...