Moodle-authenticated-RCE

Moodle 4.4.0 - Authenticated Remote Code Execution CVE-2024-43425 Exploit CVE: CVE-2024-43425 Affected Versions Moodle 4.4 to 4.4.1 Moodle 4.3 to 4.3.5 Moodle 4.2 to 4.2.8 Moodle 4.1 to 4.1.11 Description This exploit targets an authenticated Remote Code Execution RCE vulnerability in Moodle...

Linux Distros Unpatched Vulnerability : CVE-2026-102578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries,...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578

A SQL injection vulnerability exists in the Moodle learning management system. An authenticated attacker who has access to the question bank web service can submit unsanitized input that is directly processed into database queries. This flaw allows the attacker to view, alter, or delete sensitive...

CVE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

EUVD-2026-89717

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2022-35650

CVE-2022-35650 Esto es una lectura arbitraria de archivos en Moodle. Requisitos previos Debes haber comprometido un usuario a nivel de profesor o administrador. Pasos 1. Clona este repositorio: git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git 2. Ejecuta este comando para comprimir el...

WordPress LearnPress plugin 4.2.9-4.4.6 - Unauthenticated Question Bank Disclosure vulnerability

Unauthenticated Question Bank Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LearnPress versions 4.2.9-4.4.6...

CVE-2026-86445 LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...

CVE-2026-79615 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other...

EUVD-2025-4271

Malicious code in bioql PyPI...

EUVD-2022-2237

Malicious code in bioql PyPI...

EUVD-2022-4709

Malicious code in bioql PyPI...

BIT-MOODLE-2025-26530 Reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk...

Moodle 4.3.x < 4.3.8 Reflected XSS In Question Bank Filter

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.8 or 4.4.4 prior to 4.4.5 or 4.5.x prior to 4.5.1 . It is, therefore, affected by a Reflected XSS in question bank filter. Note that the scanner has not tested for these issues but has inste...

Moodle 4.4.4 < 4.4.5 Reflected XSS In Question Bank Filter

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.8 or 4.4.4 prior to 4.4.5 or 4.5.x prior to 4.5.1 . It is, therefore, affected by a Reflected XSS in question bank filter. Note that the scanner has not tested for these issues but has inste...

Moodle 4.5.x < 4.5.1 Reflected XSS In Question Bank Filter

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.8 or 4.4.4 prior to 4.4.5 or 4.5.x prior to 4.5.1 . It is, therefore, affected by a Reflected XSS in question bank filter. Note that the scanner has not tested for these issues but has inste...

Cross-site Scripting (XSS)

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing sanitization in the question bank filter. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious scrip...