MoodleExploit

Exploit de Moodle Título del Exploit: Moodle v3.4.1 RCE Exploit Google Dork: inurl:"/course/jumpto.php?jump=" Fecha: 15 Marzo 2019 Autor del Exploit: Darryn Ten Página del proveedor: https://moodle.org Enlace del software: https://github.com/moodle/moodle/archive/v3.4.1.zip Versión: 3.4.1...

CVE-2020-25627

CVE-2020-25627 XSS almacenado a través del parámetro moodlenetprofile en el perfil de usuario Mi PoC sobre este CVE Requisito de usuario: Estudiante o el sitio para registro XSS en moodlenetprofile Step 1: Log in with an authenticated user Can register or through creating a new user without...

CVE-2024-43425-Poc

CVE-2024-43425-Poc Resumen de CVE ID de CVE: CVE-2024-43425 Descripción: Moodle permite a un usuario autenticado con nivel de profesor cargar una pregunta calculada maliciosa a través de la interfaz del editor de cuestionarios. Impacto: Ejecución remota de código RCE Causa: Sanitización inadecuad...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting

Moodle Jitsi Meet 2.7 through 2.8.3 plugin contains a cross-site scripting vulnerability via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject JavaScript code to be run by the application. id: CVE-2021-26812 info: name: Moodle...

Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript...

Moodle Jmol Filter 6.1 - Local File Inclusion

Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server. id: CVE-2025-34031 info: name: Moodle Jmol Filter 6.1 - Local File Inclusion author: madrobot severity: high description: | Moodle Jmol Filter 6.1 is...

Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect

Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 contain a reflected XSS and open redirect caused by insufficient sanitization of the redirect URI in the LTI authorization endpoint, letting attackers execute scripts or redirect users maliciously, exploit requires crafted URL with...

POC-CVE-2022-30600

CVE-2022-30600 的概念验证 概述 本仓库包含 2 个针对 CVE-2022-30600 的概念验证实现。 CVE-2022-30600 是一个安全漏洞，允许攻击者绕过 moodle webapp 中的账户锁定阈值。 根据 NVD 数据库中以下条目的概述 https://nvd.nist.gov/vuln/detail/CVE-2022-30600，以下版本已知容易受此漏洞影响。 3.9 - 3.9.13 3.10 - 3.10.10 3.11 - 3.11.6 攻击细节 如用于修补此漏洞的提交中所概述，问题在于访问和增加数据库中 loginfailedcount...

CVE-2023-30943

CVE-2023-30943（Moodle self-xss） 免责声明 所有内容按“原样”提供，不附带任何明示或暗示的保证。 作者不对因使用与本存储库相关的信息或软件而造成的任何直接或间接损失承担责任。 所有材料，包括源代码，仅供教育目的提供。使用本存储库中的代码风险自负。...

CVE-2018-1133-Exploit

CVE-2018-1133-Exploit Este repositorio contiene un script de explotación en Python para el exploit del profesor malvado de Moodle CVE-2018-1133. Uso usage: Moodle Evil Teacher Exploit -h -u URL -l LOGIN -p PASSWORD -c COMMAND -P PROXY options: -h, --help show this help message and exit -u URL,...

moodle-rce-calculatedquestions

Scripts para probar la validación de entrada en preguntas calculadas de Moodle CVE-2024-43425 Este repositorio contiene los scripts complementarios de la entrada de blog De vuelta a clases - Explotando una vulnerabilidad de ejecución remota de código en Moodle, que describe una vulnerabilidad de...

CVE-2014-3551

CVE-2014-3551 Múltiples vulnerabilidades de cross-site scripting XSS en la implementación de calificación avanzada en Moodle hasta 2.3.11, 2.4.x antes de 2.4.11, 2.5.x antes de 2.5.7, 2.6.x antes de 2.6.4 y 2.7.x antes de 2.7.1 permiten a usuarios autenticados remotos inyectar secuencias de...

Linux Distros Unpatched Vulnerability : CVE-2026-102586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XS...

Linux Distros Unpatched Vulnerability : CVE-2026-102583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an...

Linux Distros Unpatched Vulnerability : CVE-2026-102582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with...

Linux Distros Unpatched Vulnerability : CVE-2026-102579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other studen...

Linux Distros Unpatched Vulnerability : CVE-2026-102584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without...

Linux Distros Unpatched Vulnerability : CVE-2026-102578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries,...