GHSA-RG56-94J7-HJX9 Moodle has a SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search...

SQL Injection

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to SQL Injection through the module list filter within course search. Remediation Upgrade moodle/moodle to version 4.1.16, 4.3.10, 4.4.6, 4.5.2 or higher. References - Git Commit - Moodle Forum Credit:...

Moodle has a SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26533

An SQL injection risk was identified in the module list filter within course search...

UBUNTU-CVE-2025-26533

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26533

CVE-2025-26533 describes an SQL injection risk in Moodle’s course search module list filter. Affected: Moodle LMS; component: module list filter in the course search. Root cause: insufficient input filtering in the filter used by course search. Impact: high to critical according to metrics in the...

CVE-2025-26533 SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26533 SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26533 SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search...

CVE-2024-13672

The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13672

The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13672 Mini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13672 Mini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13672

CVE-2024-13672 pertains to the WordPress plugin “Mini Course Generator” and enables Stored Cross-Site Scripting via the mcg shortcode on affected pages. The issue affects versions up to 1.0.5 and arises from insufficient input sanitization and output escaping for user-supplied attributes, enablin...

PT-2025-7377 · WordPress · The Mini Course Generator

Name of the Vulnerable Software and Affected Versions: The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and outpu...

WordPress Mini Course Generator plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Mini Course Generator versions = 1.0.5...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

PT-2025-7789 · Moodle +5 · Moodle +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A risk related to SQL injection was identified in the module list filter within the course search functionality. Recommendations: At the moment, there is no information about a newer version...

CVE-2024-56883

Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the...

Web Security Training

This document is aimed at those who want to learn more about web security and application penetration testing. It is coupled with a free course and provides topics with a few bullet points describing what the vulnerability entails, then a screenshot and relevant payload, demonstrating the...