CVE-2022-30599

A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria...

GHSA-JP4G-R8C9-3534 Moodle Blind SSRF Risk in /badges/mybackpack.php

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page...

Moodle Blind SSRF Risk in /badges/mybackpack.php

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page...

Moodle sensitive information disclosure

Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving 1 badges/overview.php or 2 badges/view.php...

Moodle multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge...

GHSA-C5HF-MC85-2HX4 Missing authorization in Moodle

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

CVE-2022-0984

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

Design/Logic Flaw

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

CVE-2022-0984

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

UBUNTU-CVE-2022-0984

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

CVE-2022-0984

Users with the capability to configure badge criteria teachers and managers by default were able to configure course badges with profile field criteria, which should only be available for site badges...

CVE-2022-0363

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...

CVE-2022-0363

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...

WordPress plugin myCred 安全漏洞

WordPress is a set of blogging platform developed using the PHP language. myCred 2.4.4, a WordPress plugin, previously had an authorization issue vulnerability, which stems from the plugin's failure to perform any authorization and CSRF checks in the myCred tool's import and export AJAX operation...

PT-2022-2689 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A flaw was found in Moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. The vulnerability is related to insufficient sanitization of user input...

The vulnerability of the virtual learning environment Moodle, related to the lack of access control, allows a violator to modify course icons using criteria in the profile field.

The vulnerability of the virtual learning environment Moodle is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to modify course badges using criteria in the profile field...

ROS-20220329-02

Vulnerability in the Moodle course management system, related to insufficient cleansing of user data in the Badges criteria code. Exploitation of the vulnerability could allow an attacker acting remotely, send a specially crafted query to the affected application and execute arbitrary SQL command...

GHSA-H2FW-93QX-VRCQ SQL Injection in Moodle

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default...

SQL Injection in Moodle

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default...

CVE-2022-0983

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default...