MoodleExploit

Moodle Exploit Exploit Title: Moodle v3.4.1 RCE Exploit Google Dork: inurl:"/course/jumpto.php?jump=" Date: 15 March 2019 Exploit Author: Darryn Ten Vendor Homepage: https://moodle.org Software Link: https://github.com/moodle/moodle/archive/v3.4.1.zip Version: 3.4.1 Possibly 3.5.0 and maybe even...

CVE-2020-14321

CVE-2020-14321 Course enrolments allowed privilege escalation from teacher role into manager role to RCE Maybe someone needs Python script, therefore, I have written it to exploit. How to use this PoC: How to use this PoC script Case 1. If you have vaid credentials: python3 cve202014321.py -u...

CVE-2020-14321-modified-exploit

CVE-2020-14321-modified-exploit original: https://github.com/HoangKien1020/CVE-2020-14321 Modified Moodle exploit for privilege escalation Dorvack ┌──kali㉿kali-/…/192.168.1.121/exploits/CVE-2020-14321/modified └─$ proxychains python cve202014321.py -url https://formacion.dorvack.corp -cookie...

CVE-2026-91107

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2025-25615

CVE-2025-25615 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to view the attendance list for all class sections. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint:...

CVE-2020-14321

Python script to exploit CVE-2020-14321 - Moodle 3.9 Course enrolments allowed privilege escalation from teacher role into manager role to RCE. Teachers of a course were able to assign themselves the manager role within that course. Payload extracted from:...

BIT-MOODLE-2026-102585 Moodle: group validation missing when enrolling user to course

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

MOODLE-3.X-Remote-Code-Execution

MOODLE-3.X-Remote-Code-Execution cve-2018-1133 moodle athenticated as teacher remote code execution...

CVE-2018-1133-Exploit

CVE-2018-1133-Exploit This repository contains a python exploit script for the Moodle Evil Teacher exploit CVE-2018-1133. Usage usage: Moodle Evil Teacher Exploit -h -u URL -l LOGIN -p PASSWORD -c COMMAND -P PROXY options: -h, --help show this help message and exit -u URL, --url URL Target URL -l...

CVE-2026-94620

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

CVE-2026-94620 Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

CVE-2026-94620

Prior to version 1.11.0 , the Classroom 50 tool is vulnerable to an arbitrary file write when using the gh teacher download command. The root cause is that the tool follows symlinks when writing autograde artifacts (result.json and results.json) into a student's cloned repository. An attacker can...

CVE-2026-94620 Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

CVE-2026-94620 Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

EUVD-2026-90884

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

CVE-2026-94620: Improper Limitation of a Pathname to a Restricted Directory

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

PT-2026-103908

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

Linux Distros Unpatched Vulnerability : CVE-2026-102585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group...

CVE-2026-102585

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

UBUNTU-CVE-2026-102585

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...