BIT-MOODLE-2026-102583 Moodle: incorrect capability check in ai generate image web service

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI...

BIT-MOODLE-2026-102582 Moodle: manual enrolment page accessible when plugin disabled

A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments...

BIT-MOODLE-2026-102581 Moodle: xss in forum post templates due to insufficient escaping

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing t...

BIT-MOODLE-2026-102580 Moodle: arbitrary class instantiation via report builder audience classname

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

BIT-MOODLE-2026-102579 Moodle: user profile information disclosure via grade web service

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure...

BIT-MOODLE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

BIT-MOODLE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

MOODLE-3.X-Remote-Code-Execution

MOODLE-3.X-Remote-Code-Execution cve-2018-1133 ثغرة تنفيذ التعليمات البرمجية عن بُعد في Moodle عند المصادقة كمعلّم...

moodle-token-stealer

لا يحتوي هذا المستودع على ملف README...

CVE-2022-35650

CVE-2022-35650 هذه قراءة ملف تعسفية في مودل. المتطلبات الأساسية يجب أن تكون قد اخترقت مستخدمًا بمستوى معلم أو مسؤول. الخطوات 1. استنسخ هذا المستودع: git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. شغّل هذا الأمر لضغط الاستغلال في ملف مضغوط: zip exploit.zip imsmanifest.xml pool.dat 3...

Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting

Moodle Jitsi Meet 2.7 through 2.8.3 plugin contains a cross-site scripting vulnerability via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject JavaScript code to be run by the application. id: CVE-2021-26812 info: name: Moodle...

POC-CVE-2022-30600

إثبات المفهوم لـ CVE-2022-30600 نظرة عامة يحتوي هذا المستودع على تطبيقين لإثبات المفهوم الذي يستغل CVE-2022-30600. CVE-2022-30600 هي ثغرة أمنية تسمح للمهاجم بتجاوز حد قفل الحساب داخل تطبيق moodle web. كما هو موضح في الإدخال التالي في قاعدة بيانات NVD https://nvd.nist.gov/vuln/detail/CVE-2022-3060...

CVE-2023-30943

CVE-2023-30943 Moodle self-xss إخلاء المسؤولية جميع المحتويات مقدمة "كما هي"، دون أي ضمانات، صريحة أو ضمنية. المؤلفون غير مسؤولين عن أي ضرر، مباشر أو غير مباشر، ينشأ عن استخدام المعلومات أو البرامج المرتبطة بهذا المستودع. جميع المواد، بما في ذلك الكود المصدري، مقدمة لأغراض إعلامية فقط. استخدام...

CVE-2018-1133-Exploit

CVE-2018-1133-Exploit Ce dépôt contient un script d'exploitation Python pour l'exploit Moodle Evil Teacher CVE-2018-1133. Utilisation usage: Moodle Evil Teacher Exploit -h -u URL -l LOGIN -p PASSWORD -c COMMAND -P PROXY options: -h, --help show this help message and exit -u URL, --url URL Target...

Linux Distros Unpatched Vulnerability : CVE-2026-102587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-102581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting XSS vulnerability. An...

Linux Distros Unpatched Vulnerability : CVE-2026-102583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an...

Linux Distros Unpatched Vulnerability : CVE-2026-102585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group...

Linux Distros Unpatched Vulnerability : CVE-2026-102578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries,...

Linux Distros Unpatched Vulnerability : CVE-2026-102579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other studen...