Filtered by vendor Moodle Subscriptions
Filtered by product Moodle Subscriptions
Total 632 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2014-0008 1 Moodle 1 Moodle 2025-04-11 N/A
lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated administrators to obtain sensitive information by reading the Config Changes Report.
CVE-2014-0010 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-04-11 N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields.
CVE-2013-1831 1 Moodle 1 Moodle 2025-04-11 N/A
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
CVE-2013-1829 1 Moodle 1 Moodle 2025-04-11 N/A
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
CVE-2013-2082 1 Moodle 1 Moodle 2025-04-11 N/A
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.
CVE-2013-2079 1 Moodle 1 Moodle 2025-04-11 N/A
mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.
CVE-2013-2243 1 Moodle 1 Moodle 2025-04-11 N/A
mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document.
CVE-2010-2230 1 Moodle 1 Moodle 2025-04-11 N/A
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
CVE-2013-2080 1 Moodle 1 Moodle 2025-04-11 N/A
The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
CVE-2012-2358 1 Moodle 1 Moodle 2025-04-11 N/A
Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass an activity's read-only state and modify the database by leveraging the student role and editing database activity entries that already exist.
CVE-2012-2357 1 Moodle 1 Moodle 2025-04-11 N/A
The Multi-Authentication feature in the Central Authentication Service (CAS) functionality in auth/cas/cas_form.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network.
CVE-2012-2353 1 Moodle 1 Moodle 2025-04-11 N/A
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
CVE-2012-6087 1 Moodle 1 Moodle 2025-04-11 N/A
repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to an incorrect CURLOPT_SSL_VERIFYHOST value.
CVE-2024-38276 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-03-26 8.8 High
Incorrect CSRF token checks resulted in multiple CSRF risks.
CVE-2024-34008 1 Moodle 1 Moodle 2025-03-25 3.5 Low
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.
CVE-2021-36399 1 Moodle 1 Moodle 2025-03-07 5.4 Medium
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
CVE-2021-36398 1 Moodle 1 Moodle 2025-03-07 5.4 Medium
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
CVE-2021-36397 1 Moodle 1 Moodle 2025-03-07 5.3 Medium
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
CVE-2021-36395 1 Moodle 1 Moodle 2025-03-07 7.5 High
In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.
CVE-2021-36403 1 Moodle 1 Moodle 2025-03-07 5.3 Medium
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.