Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
MoodleMoodle2.7.12

16 matches found

CVE
CVE•added 2017/03/26 6:59 p.m.•90 views

CVE-2017-2641

In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

9.8CVSS9.7AI score0.01895EPSS
CVE
CVE•added 2017/05/15 2:29 p.m.•59 views

CVE-2017-7489

In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.

6.5CVSS6AI score0.00254EPSS
CVE
CVE•added 2017/05/15 2:29 p.m.•55 views

CVE-2017-7490

In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.

5.3CVSS5.6AI score0.00237EPSS
CVE
CVE•added 2016/05/22 8:59 p.m.•52 views

CVE-2016-2190

Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

5.3CVSS6.3AI score0.00375EPSS
CVE
CVE•added 2016/05/22 8:59 p.m.•51 views

CVE-2016-2153

Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted field in a URL, as demonstr...

6.1CVSS6.3AI score0.00255EPSS
CVE
CVE•added 2017/05/15 2:29 p.m.•51 views

CVE-2017-7491

In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

4.3CVSS5.1AI score0.0013EPSS
CVE
CVE•added 2017/04/20 9:59 p.m.•50 views

CVE-2016-3729

The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.

6.5CVSS6.9AI score0.0024EPSS
CVE
CVE•added 2016/05/22 8:59 p.m.•48 views

CVE-2016-2156

calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-s...

4.3CVSS5.5AI score0.00259EPSS
CVE
CVE•added 2017/04/20 9:59 p.m.•48 views

CVE-2016-3734

Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.

8.8CVSS8.7AI score0.00087EPSS
CVE
CVE•added 2017/04/20 9:59 p.m.•46 views

CVE-2016-3733

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.

4.3CVSS4.5AI score0.00298EPSS
CVE
CVE•added 2016/05/22 8:59 p.m.•45 views

CVE-2016-2158

lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the gues...

4.3CVSS5.9AI score0.00282EPSS
CVE
CVE•added 2016/05/22 8:59 p.m.•43 views

CVE-2016-2157

Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignm...

8.8CVSS8.8AI score0.00111EPSS
CVE
CVE•added 2016/05/22 8:59 p.m.•42 views

CVE-2016-2151

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresse...

4.3CVSS5.8AI score0.00281EPSS
CVE
CVE•added 2016/05/22 8:59 p.m.•42 views

CVE-2016-2152

Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field.

6.1CVSS6.7AI score0.00255EPSS
Web
CVE
CVE•added 2016/05/22 8:59 p.m.•41 views

CVE-2016-2159

The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service reque...

4.3CVSS5.8AI score0.00219EPSS
CVE
CVE•added 2017/04/20 9:59 p.m.•40 views

CVE-2016-3732

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.

4.3CVSS5AI score0.0015EPSS