The vulnerability of the “Gradebook” module implementation in the virtual learning environment Moodle allows a violator to gain unauthorized access to protected information.

The vulnerability of the “Gradebook” module in the virtual learning environment Moodle is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2021-2241 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.10.1 Moodle versions prior to 3.9.4 Moodle versions prior to 3.8.7 Description: The issue is related to insufficient capability checks in some grade-related web services, allowing students to view other students'...

CVE-2012-1158

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export...

CVE-2012-1158

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export Versions 2.2 to 2.2.1+, 2.1 to 2.1.4+ are affected...

Design/Logic Flaw

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export...

CVE-2012-1158

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export...

CVE-2012-1158

CVE-2012-1158 affects Moodle before 2.2.2. The vulnerability is a course information leak in the gradebook export, allowing users to see hidden grade items in exported data. The NVD entry confirms the impact as partial confidentiality loss with no integrity or availability impact, rating CVSSv3.1...

Chamilo LMS Cross-Site Scripting Vulnerability (CNVD-2018-26468)

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. A cross-site scripting vulnerability exists in the...

CVE-2018-20327

Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebooklist.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of t...

Design/Logic Flaw

Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebooklist.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of t...

CVE-2018-20327

Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebooklist.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of t...

CVE-2018-20327

Chamilo LMS 1.11.8 is affected by a cross-site scripting (XSS) vulnerability in main/template/default/admin/gradebook_list.tpl within the gradebook dependencies tool. The issue allows authenticated users to affect other users under specific administrator-granted permissions. The connected sources...

Cross-Site Scripting (XSS)

Moodle is vulnerable to cross-site scriptingXSS attacks. The attacks are possible because the application does not use the RISKXSS flag in mod/quiz/db/access.php, allowing attackers to use this loophole when providing gradebook feedback for manual quiz grading...

ATutor PHP Code Injection Vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. An eval injection vulnerability exists in the mods/standard/gradebook/editmarks.php script in ATutor 2.2...

Sql injection

Multiple eval injection vulnerabilities in mods/standard/gradebook/editmarks.php in ATutor 2.2 and earlier allow remote authenticated users with the ATPRIVGRADEBOOK privilege to execute arbitrary PHP code via the 1 asc or 2 desc parameter...

CVE-2015-7712

Multiple eval injection vulnerabilities in mods/standard/gradebook/editmarks.php in ATutor 2.2 and earlier allow remote authenticated users with the ATPRIVGRADEBOOK privilege to execute arbitrary PHP code via the 1 asc or 2 desc parameter...

CVE-2015-7712

ATutor 2.2 and earlier contains a PHP code injection vulnerability in mods/_standard/gradebook/edit_marks.php that allows remote authenticated users with AT_PRIV_GRADEBOOK privilege to execute arbitrary PHP code via the asc or desc parameters. This is a classic eval/ injection flaw in the gradebo...

CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

UBUNTU-CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...