moodle-rce-calculatedquestions

Script per testare la validazione dell'input nelle domande calcolate di Moodle CVE-2024-43425 Questo repository contiene gli script di accompagnamento al post del blog Back to School - Exploiting a Remote Code Execution Vulnerability in Moodle, che descrive una vulnerabilità di esecuzione di codi...

moodle-cve

Criação de desafio Inspiração moodle CVE-2025-26529: envenenando os logs do admin para assumir totalmente a conta do admin @ref: https://www.youtube.com/watch?v=dhVF6hQUzWU @ref: https://github.com/NightBloodz/moodleTestingEnv @ref:...

PoC-CVE-2025-26529

PoC para CVE-2025-26529 – Exploração de XSS para RCE no Moodle Este é um Proof of Concept PoC que demonstra a cadeia de vulnerabilidades SSRF para XSS → XSS para RCE no Moodle. Visão Geral Enviei todos os arquivos necessários para demonstrar toda a cadeia de exploração: 1. SSRF para XSS 2...

POC-CVE-2022-30600

Proof of concept per CVE-2022-30600 Panoramica Questo repository contiene 2 implementazioni per un proof of concept che sfrutta CVE-2022-30600. CVE-2022-30600 è una vulnerabilità di sicurezza che consente a un attaccante di bypassare la soglia di blocco dell'account all'interno del webapp moodle...

CVE-2021-21809

CVE-2021-21809 POC CVE विवरण: Moodle 3.10 में डिफ़ॉल्ट लिगेसी स्पेलचेकर प्लगइन में एक कमांड निष्पादन कमज़ोरी मौजूद है। विशेष रूप से तैयार किए गए HTTP अनुरोधों की एक श्रृंखला कमांड निष्पादन की ओर ले जा सकती है। इस कमज़ोरी का दोहन करने के लिए हमलावर के पास व्यवस्थापक विशेषाधिकार होने चाहिए। नीचे दि...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

Moodle Jmol Filter 6.1 - Local File Inclusion

Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server. id: CVE-2025-34031 info: name: Moodle Jmol Filter 6.1 - Local File Inclusion author: madrobot severity: high description: | Moodle Jmol Filter 6.1 is...

Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript...

Moodle - Remote Code Execution

Attackers with the permission to create or modify questions in Moodle courses are able to craft malicious inputs for calculated questions, which can be abused to execute arbitrary commands on the underlying system. id: CVE-2024-43425 info: name: Moodle - Remote Code Execution author:...

Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect

Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 contain a reflected XSS and open redirect caused by insufficient sanitization of the redirect URI in the LTI authorization endpoint, letting attackers execute scripts or redirect users maliciously, exploit requires crafted URL with...

CVE-2021-36393

CVE-2021-36393 Fehlerbasierte blinde SQL-Injection mit Bit-Shifting-Ansatz für Moodle 3.10.4. Ermöglicht einem Angreifer, beliebige Datenbankabfragen durchzuführen. Zum Beispiel können Sie stehlen: Testantworten aus der Datenbank Ändern Sie die Datei script.js und führen Sie sie auf der Route...

moodle-login-csrf

Questo repository contiene i file utilizzati per scoprire e sfruttare due bug di moodle, MSA-18-0020 CVE-2018-16854 e MSA-19-0004 CVE-2019-3847, che sfruttano la capacità degli utenti di aggiungere JavaScript ai propri dashboard. MSA-18-0020 si basa su CSRF nel modulo di login, mentre MSA-19-0004...

MoodleExploit

استغلال Moodle عنوان الاستغلال: Moodle v3.4.1 RCE Exploit Google Dork: inurl:"/course/jumpto.php?jump=" التاريخ: 15 مارس 2019 مؤلف الاستغلال: Darryn Ten الصفحة الرئيسية للبائع: https://moodle.org رابط البرنامج: https://github.com/moodle/moodle/archive/v3.4.1.zip الإصدار: 3.4.1 ربما 3.5.0 وربما حت...

Moodle-authenticated-RCE

Moodle 4.4.0 - Esecuzione remota di codice autenticata CVE-2024-43425 Exploit CVE: CVE-2024-43425 Versioni affette Moodle 4.4 fino a 4.4.1 Moodle 4.3 fino a 4.3.5 Moodle 4.2 fino a 4.2.8 Moodle 4.1 fino a 4.1.11 Descrizione Questo exploit sfrutta una vulnerabilità di esecuzione remota di codice R...

CVE-2022-28601

CVE-2022-28601 Una vulnerabilità di bypass dell'autenticazione a due fattori 2FA nel "Simple 2FA Plugin for Moodle" di LMS Doctor Vulnerability Details Rischio : Medio Fornitore: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Segnalata da: Flaviu Popescu Descrizione: La vulnerabili...

Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting

Moodle Jitsi Meet 2.7 through 2.8.3 plugin contains a cross-site scripting vulnerability via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject JavaScript code to be run by the application. id: CVE-2021-26812 info: name: Moodle...

Moodle-CVE-2018-1042

Moodle CVE-2018-1042 Skript zur Ausnutzung von CVE-2018-1042, um interne Portscans durchzuführen...

CVE-2020-25627

CVE-2020-25627 XSS persistente tramite il parametro moodlenetprofile nel profilo utente La mia PoC su questa CVE Requisito utente: Studente o il sito per la registrazione XSS in moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through creating a new user...

CVE-2022-28986

CVE-2022-28986 Una vulnerabilità di Insecure Direct Object References IDOR nel "Simple 2FA Plugin for Moodle" di LMS Doctor Dettagli della vulnerabilità Rischio : Critico Fornitore: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Divulgato da: Flaviu Popescu Descrizione: Vulnerabili...