CVE-2012-1160

Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php...

CVE-2012-1160: Incorrect Permission Assignment for Critical Resource

Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php...

Moodle CMS 3.6.x <= 3.6.2 Authentication Bypass Vulnerability

Moodle CMS is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...

Moodle 2.5.x < 2.5.5 Multiple Vulnerabilities

Binary data 9423.prm...

The vulnerability of the Moodle learning management system allows a hacker to bypass existing access restrictions.

The vulnerability of the mod/forum/post.php function in the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions through group-based authenticatio...

CVE-2015-3273: Undefined Security Weakness

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization...

CVE-2014-7834: Undefined Security Weakness

mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forumgetdiscussions web service...

CVE-2014-3617

The CVE-2014-3617 issue affects Moodle’s forum: the function forum_print_latest_discussions in mod/forum/lib.php allowed remote authenticated users to bypass the requirement to post an answer and to discover an author’s username by visiting a Q&A forum, without needing the mod/forum:viewqandawith...

Code injection

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2012-3392: Undefined Security Weakness

mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums...

CVE-2012-3391: Undefined Security Weakness

mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a...

CVE-2012-0792: Exposure of Sensitive Information to an Unauthorized Actor

mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts...

CVE-2011-4308: Undefined Security Weakness

mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors...

phpBB MOD Forum picture and META tags 1.7 RFI Vulnerability

Exploit for unknown platform in category web applications =========================================================== phpBB MOD Forum picture and META tags 1.7 RFI Vulnerability =========================================================== Exploitname: phpBB Module Forum picture and META tags 1.7...

CVE-2006-6625: Undefined Security Weakness

Cross-site scripting XSS vulnerability in mod/forum/discuss.php in Moodle 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the navtail parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...