CVE-2026-58340

A flaw was found in Moodle. The grade item ID number editing functionality lacked proper security measures, making it vulnerable to Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS. A remote attacker could exploit these vulnerabilities to perform unauthorized actions or inject malicio...

CVE-2026-58339

A flaw was found in the Moodle Feedback activity module. Insufficient sanitization of the Feedback import error message could allow a remote attacker to perform a reflected Cross-Site Scripting XSS attack. This vulnerability enables the attacker to inject malicious scripts into a user's web...

CVE-2026-58346

A flaw was found in Moodle. A site administrator could exploit a blind Server-Side Request Forgery SSRF vulnerability. This vulnerability exists in the MNet peers management functionality due to insufficient validation of peer hostnames against the cURL blocked hosts configuration. This could all...

CVE-2026-58344

A flaw was found in Moodle. The regrade action in the quiz overview report did not include the necessary token, leading to a Cross-Site Request Forgery CSRF vulnerability. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, such as regrading...

CVE-2026-58345

A flaw was found in Moodle. Insufficient capability checks in the Assignment module allowed users without the necessary permissions to allocate markers to submissions. This vulnerability could lead to unauthorized modification of assignment data, effectively granting a limited form of privilege...

CVE-2026-58343

A flaw was found in Moodle. Capability checks were missing from course assistance AI Artificial Intelligence placement web services. This could allow users to make requests to these web services without possessing the necessary permissions, potentially leading to unauthorized access to AI course...

CVE-2026-58341

A flaw was found in Moodle. The actions to enable and disable group messaging did not include the necessary token to prevent a Cross-Site Request Forgery CSRF risk. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, potentially leading to...

Directory Traversal

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Directory Traversal via the group messaging state toggle process. An attacker can cause unauthorized changes to group messaging settings by tricking an authenticated user into submitting a crafted...

CVE-2026-58348

A flaw was found in Moodle. Missing capability checks in the report builder fragment callbacks could allow authenticated users to retrieve report data that they are not authorized to access. This could lead to information disclosure...

CVE-2026-18025

Insufficient Moodle app token isolation made it possible for a Moodle site being logged into the app to access secure-storage tokens for other Moodle sites the user already had configured in their Moodle mobile app. This could result in compromise of the user’s web service token if, for example,...

CVE-2026-65882: Improper Neutralization of Input During Web Page Generation

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

PT-2026-65480

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

ANT-2026-XBE9HJ4Y · moodle · Path-traversal

path-traversal high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-XBE9HJ4Y: Path Traversal → Arbitrary File Write → RCE ...

CVE-2026-54733

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

CVE-2026-54733

The Moodle integration for Microsoft 365/Entra ID (local_o365) is vulnerable prior to 4.5.6, 5.0.5, and 5.1.1. The Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users based on the upn claim without verifying the JWT signature, enabling an unauthenticated attacker...

CVE-2026-54733

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

CVE-2026-54733 moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

EUVD-2026-44938

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

CVE-2026-54733 moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

CVE-2026-54733 moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...