CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

CVE-2022-40208

In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.

CVE-2021-36568

In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3...

CVE-2023-28336

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

CVE-2023-28333

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

CVE-2021-36399

In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.

CVE-2023-28331

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.

CVE-2023-1402

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

CVE-2023-28332

If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

CVE-2023-28330

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

CVE-2021-36398

In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.