CVE-2006-4942

Moodle before 1.6.2, when the configuration lacks 1 algebra or 2 tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via a filter/algebra/pix.php or b filter/tex/pix.php...

CVE-2006-4942

Moodle before 1.6.2 is affected. When the configuration lacks either (1) algebra or (2) tex filters, remote authenticated users can write LaTeX or MimeTeX output files to the top level of the dataroot directory via filter/algebra/pix.php or filter/tex/pix.php. Root cause is insufficient filtering...

CVE-2006-4940

CVE-2006-4940 affects Moodle prior to 1.6.2. The issue is in login/forgot_password.php, where a find action can cause disclosure of sensitive user data, specifically e-mail addresses and Moodle account names. The NVD entry records a base CVSS score of 5.0 (Medium) with network access, low attack ...

CVE-2006-4937

lib/setup.php in Moodle before 1.6.2 sets the error reporting level to 7 to display EWARNING messages to users even if debugging is disabled, which might allow remote authenticated users to obtain sensitive information by triggering the messages...

CVE-2006-4938

Moodle before 1.6.2 contains a vulnerability in help.php where it does not verify the existence of certain help files before including them, which may allow a remote authenticated user to cause an error message that reveals the file path. The CVE is documented in multiple sources (NVD entry for C...

CVE-2006-4936

Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object. Affects Moodle prior to 1.6.2; underlying cause is improper validation. Impact is described as unspecified, with remote attack vectors mentioned in the provided materials; no remediation de...

CVE-2006-4937

CVE-2006-4937 impacts Moodle prior to 1.6.2. The vulnerable code is in lib/setup.php, which sets the error reporting level to 7 to display E_WARNING messages even when debugging is disabled. This could allow remote authenticated users to obtain sensitive information by triggering warning messages...

CVE-2006-4941

CVE-2006-4941 describes multiple cross-site scripting (XSS) vulnerabilities in Moodle prior to version 1.6.2, allowing remote attackers to inject arbitrary web script or HTML via (1) the choose parameter in files/index.php and (2) the sub parameter in doc/index.php. The connected documents indica...

CVE-2006-4939

backup/backupscheduled.php in Moodle before 1.6.2 generates trace data with the full backup pathname even when debugging is disabled, which might allow attackers to obtain the pathname...

Sql injection in Moodle

Hi, There is a sql injection in Moodle 1.6.1+ and maybe before versions : The "$blogEntry" parameter passed to "insertrecord" function in /blog/edit.php, is not checked properly . Version 1.6.2 has been released moodle.org. - Omid...

Moodle < 1.6.2 Multiple Vulnerabilities

The installed version of Moodle fails to sanitize user-supplied input to a number of parameters and scripts. An attacker can leverage these issues to launch SQL injection and cross-site scripting attacks against the affected application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2006-4786

Moodle 1.6.1 and earlier allows remote attackers to obtain sensitive information via 1 help.php and 2 other unspecified vectors involving scheduled backups...

CVE-2006-4785

SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insertrecord function, which calls adodbcolumnsql in the adodb lay...

CVE-2006-4786

Moodle 1.6.1 and earlier allows remote attackers to obtain sensitive information via 1 help.php and 2 other unspecified vectors involving scheduled backups...

CVE-2006-4784

Multiple cross-site scripting XSS vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 doc/index.php or 2 files/index.php...

CVE-2006-4784

Multiple cross-site scripting XSS vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 doc/index.php or 2 files/index.php...

CVE-2006-4785

SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insertrecord function, which calls adodbcolumnsql in the adodb lay...

CVE-2006-4786

CVE-2006-4786 affects Moodle 1.6.1 and earlier. Remote attackers can obtain sensitive information via (1) help.php and (2) other unspecified vectors involving scheduled backups, causing partial confidentiality impact. The provided connected sources confirm the vulnerability pattern but do not inc...

CVE-2006-4784

Multiple cross-site scripting XSS vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 doc/index.php or 2 files/index.php...

CVE-2006-4784

CVE-2006-4784 concerns multiple cross-site scripting (XSS) flaws in Moodle 1.6.1 and earlier. The connected materials indicate the vulnerability stems from unsanitized inputs in Moodle pages, enabling an attacker to inject arbitrary script or HTML via unspecified parameters to the affected entry ...