22 matches found
CVE-2025-67259
A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST...
CVE-2026-30884: Authorization Bypass Through User-Controlled Key
mdjnelson/moodle-modcustomcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds mod/customcert:manage in any single course can read and silently overwrite certificate elements...
Linux Distros Unpatched Vulnerability : CVE-2025-62394
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages...
CVE-2025-62393
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details...
Access Control Bypass
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass in the courseoutputfragmentcourseoverview function. An attacker can gain unauthorized access to limited course information by bypassing access permission checks. Remediation...
CVE-2025-62394 Moodle: quiz notifications sent to suspended participants
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information...
EUVD-2025-35672
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information...
CVE-2025-62394 Moodle: quiz notifications sent to suspended participants
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information...
Moodle 安全漏洞
Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from the course overview output feature not fully enforcing user access...
PT-2025-43442
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Moodle did not properly check enrolment status when sending notifications about quizzes. This allowed suspended or inactive users to receive quiz-related messages, potentially revealing limite...
EUVD-2012-1191
Malware in sbrugna...
EUVD-2012-1189
Malware in sbrugna...
EUVD-2022-3813
Malicious code in bioql PyPI...
CVE-2025-31340: Improper Control of Filename for Include/Require Statement in PHP Program
A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file...
Moodle allows attackers to obtain sensitive course information
lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course...
GHSA-FP4H-J22R-VWCV Moodle allows attackers to obtain sensitive course information
lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course...
Moodle allows attackers to obtain username and course information
Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...
PT-2021-15730
Name of the Vulnerable Software and Affected Versions: Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.7.7 Description: The issue concerns unprotected AJAX endpoints in the plugin, which allows students to modify course information and elevate their privilege...
Moodle 安全漏洞
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17, which stems from a failure to validate that a requesting...
