CVE-2015-5338

CVE-2015-5338 affects Moodle’s lesson module, enabling CSRF that can hijack user authentication for requests to mod/lesson/mediafile.php or mod/lesson/view.php. Impacted versions are Moodle up to 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3. The connected sources confir...

CVE-2015-5264

The CVE-2015-5264 entry concerns Moodle’s lesson module. Affected versions include Moodle 2.6.11 and 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2. Remote authenticated users could bypass access restrictions and submit additional answer attempts by leveraging the student role. R...

CVE-2015-5264

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role...

CVE-2015-5338: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to 1 mod/lesson/mediafile.php or 2...

CVE-2015-5264: Undefined Security Weakness

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role...

PT-2016-1304

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.6.11 Moodle versions 2.7.x before 2.7.11 Moodle versions 2.8.x before 2.8.9 Moodle versions 2.9.x before 2.9.3 Description The issue is related to multiple cross-site request forgery CSRF vulnerabilities in the lesso...

Moodle 2.7.x < 2.7.10 / 2.8.x < 2.8.8 / 2.9.x < 2.9.2 Multiple Vulnerabilities

Binary data 8969.prm...

Updated moodle packages fix security vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.8.8, completed and graded lesson activity was not protected against making new attempts to answer some questions, so students could re-attempt answering questions in the lesson CVE-2015-5264. In Moodle before 2.8.8, users...

PT-2016-1292

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier Moodle versions 2.7.x through 2.7.9 Moodle versions 2.8.x through 2.8.7 Moodle versions 2.9.x through 2.9.1 Description The issue is related to insufficient access control in the lesson module of Moodle,...

The vulnerability of the Moodle learning management system allows a hacker to execute cross-site scripting attacks.

The vulnerability of the Lesson module in the Moodle learning management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting using the feedback form...

Moodle Lesson Module Cross-Site Scripting Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment.Lesson is one of the modules for selecting courses online. A security vulnerability exists in the access.php script in the Lesson modul...

UBUNTU-CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

CVE-2015-0216: Improper Neutralization of Input During Web Page Generation

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

PT-2015-1608

Name of the Vulnerable Software and Affected Versions Moodle versions 2.8.x through 2.8.1 Description The issue allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback. This is due to the failure to set the RISK XSS bit for graders in the access.ph...

phpems某处设计失误导致3枚SQL注入漏洞

简要描述： phpems某处设计失误导致3枚SQL注入漏洞 详细说明： 4. PHPems再来3枚SQL注入漏洞吧 存在漏洞代码位置在/app/exam/app.php的lesson函数中 public function lesson $action = $this-ev-url3; $page = $this-ev-get'page'; switch$action case 'ajax': switch$this-ev-url4 case 'questions': $number = $this-ev-get'number'; if!$number$number = 1; $quest...

eFront 3.6.14 (build 18012) - Stored XSS in Multiple Parameters

No description provided by source. Exploit-DB Note: Screenshot provided by exploit author. Exploit Title: eFront v3.6.14 build 18012 -Stored XSS in multiple Parameters Author: sajith version: eFront v3.6.14- build 18012 Vendor Homepage: http://www.efrontlearning.net/ vulnerable app...

saphp Lesson add.php forumid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15185/info saphp Lesson is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...

PT-2013-6294

Name of the Vulnerable Software and Affected Versions eFront version 3.6.14 build 18012 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML via the Last name, Lesson name, or Course name field in the www/administrator.php file. This can be...

eFront 3.6.14 Cross Site Scripting

EDB Note: Screenshot provided by exploit author. Exploit Title: eFront v3.6.14 build 18012 -Stored XSS in multiple Parameters Author: sajith version: eFront v3.6.14- build 18012 Vendor Homepage: http://www.efrontlearning.net/ vulnerable app link:http://www.efrontlearning.net/download POC by sajit...