PT-2026-103086

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, leading to a SQL Structured Query Language injection. This...

CVE-2026-102585: Placement of User into Incorrect Group

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

CVE-2026-102584: Direct Request

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessme...

CVE-2026-102577: Server-Side Request Forgery (SSRF)

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102586: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

PT-2026-103094

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Insufficient sanitization of the username input on the password reset page allows a remote attacker to perform a cross-site scripting XSS attack. XSS is a flaw where malicious scripts are...

PT-2026-103088

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker can provide an improperly validated audience class name to the Report Builder component, leading to arbitrary class instantiation. This allows the unauthorized creati...

PT-2026-103096

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. CSRF is a flaw that allows an attacker to trick an authenticated user into performing actions they d...

PT-2026-103087

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course without proper permission,...

PT-2026-103093

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw exists where the application fails to verify if a selected group belongs to a specific course during the user enrollment process. An authenticated user with teacher privileges can explo...

CVE-2026-102580: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

PT-2026-103089

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS flaw. This allows an attacker to inject malicious content into a forum post, whi...

CVE-2026-102581: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

USN-8805-1: Moodle vulnerability

It was discovered that Moodle did not properly restrict URLs. An authenticated user could possibly use this issue to perform a server-side request forgery attack and expose sensitive information...

USN-8805-1 moodle vulnerability

It was discovered that Moodle did not properly restrict URLs. An authenticated user could possibly use this issue to perform a server-side request forgery attack and expose sensitive information...

PT-2026-97387

Name of the Vulnerable Software and Affected Versions Moodle Socialwall plugin versions 3.0 through 3.3 Description A SQL injection flaw allows an attacker to execute arbitrary code by sending specially crafted HTTP requests. SQL injection is a technique where malicious SQL statements are inserte...

EUVD-2025-210998

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...