The vulnerability of the Moodle learning management system allows a hacker to circumvent existing restrictions on access time limits.

The vulnerability of the savesubmission function in the Moodle learning management system’s code mod/assign/externallib.php is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing time-based access restrictions by using the...

CVE-2016-2159

The savesubmission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service...

CVE-2016-2151

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail...

Cross site request forgery (csrf)

The savesubmission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service...

CVE-2016-2151

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail...

o2.sms.cz XSS vulnerability

Vulnerable URL: http://o2.sms.cz/index.php?Pidkategorie=7630soubor=student%2Findex.php%3Fakce%3Dhledej%26akceHledej%3D1%26hlKde1%3D1%26studweb%3D0%26hlText%3D%2527%2522%253E%25 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS...

seznamka.sms.cz XSS vulnerability

Vulnerable URL: http://seznamka.sms.cz/index.php?Pidkategorie=7630soubor=student%2Findex.php%3Fakce%3Dhledej%26akceHledej%3D1%26hlKde1%3D1%26studweb%3D0%26hlText%3D%2527%2522%253E%25%3Cscript%3Ealert%28%22OPENBUGBOUNTY%22%29%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest che...

MIT Launches Experimental Bug Bounty Program

The effectiveness of bug bounty programs is difficult to deny, especially after adoption of one at Uber, which announced last month it would begin paying $10,000 for critical bugs, and the Department of Defense, whose Hack the Pentagon illustrates the government’s softening stance on hackers. The...

Charade Student - Corrupted files, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Charade Student published at the 'play' market has multiple vulnerabilities...

ATutor 2.2.1 - Directory Traversal / Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'ATutor 2.2.1 Directory Traversal / Remote Code Execution', 'Description' = %q This module exploits a directory traversal...

ATutor 2.2.1 Directory Traversal / Remote Code Execution

This module exploits a directory traversal vulnerability in ATutor on an Apache/PHP setup with displayerrors set to On, which can be used to allow us to upload a malicious ZIP file. On the web application, a blacklist verification is performed before extraction, however it is not sufficient to...

The vulnerabilities in the Moodle learning management system allow a hacker to inject arbitrary Web or HTML code.

Multiple vulnerabilities exist in the Moodle learning management system module, due to the lack of measures taken to protect the website structure. Exploitation of these vulnerabilities allows attackers to inject arbitrary Web or HTML code, through the use of the “student” role and a specially...

CVE-2015-5336

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

UBUNTU-CVE-2015-5336

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

CVE-2015-5336

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

Golestan System Of Iran SQL Injection

In The Name Of God Exploit Title : Golestan System Of Iran Login Bypass Vulnerability Exploit Author : 4TT4CK3R Tested on : Internet Explorer , Kali Linux , Windows 8.1 HomePage : https://reg.pnu.ac.ir Vendor Page : https://reg1.pnu.ac.ir/forms/authenticateuser/main.htm Thanks to : Behrooz...

Banner Student Product URL Redirection Vulnerability

Banner Student is used to query and manage student records and information. A URL redirection vulnerability exists in the Banner Student product, which can be exploited by an attacker to redirect to a malicious page...

Department of Education Lambasted Over Database Vulnerabilities

Like the Office of Personnel Management before it, the Department of Education has failed to heed repeated warnings that its systems contain multiple weaknesses. In a House Committee on Oversight and Government Reform hearing held this week, Congressman and committee chair Jason Chaffetz R-Utah...

src.ac.uk XSS vulnerability

Vulnerable URL: http://www.src.ac.uk/student-life/134-courses/part-time-courses/engineering-skills/641-recreational-welding? Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 22:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...