A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
Source: MITRE
Max CVSS
6.5
EPSS Score
0.04%
Published
2024-03-21
Updated
2024-03-21
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Source: Fedora Project
Max CVSS
6.3
EPSS Score
0.07%
Published
2023-06-22
Updated
2024-04-19
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-06-22
Updated
2024-04-19
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
Source: Fedora Project
Max CVSS
6.5
EPSS Score
1.16%
Published
2023-05-02
Updated
2024-04-19
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.09%
Published
2023-03-23
Updated
2024-04-19
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.09%
Published
2023-03-23
Updated
2024-04-19
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Source: Fedora Project
Max CVSS
6.5
EPSS Score
0.12%
Published
2023-03-23
Updated
2024-04-19
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.12%
Published
2023-02-17
Updated
2023-02-28
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.12%
Published
2023-02-17
Updated
2023-02-28
The course upload preview contained an XSS risk for users uploading unsafe data.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-15
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
Source: Fedora Project
Max CVSS
6.5
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-15
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-15
A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.
Source: Elastic
Max CVSS
6.1
EPSS Score
0.12%
Published
2022-11-23
Updated
2023-01-31
Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.
Source: Israel National Cyber Directorate
Max CVSS
6.5
EPSS Score
0.06%
Published
2023-01-12
Updated
2023-01-20
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
1.15%
Published
2022-07-25
Updated
2022-12-21
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.17%
Published
2022-07-25
Updated
2022-12-21
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.31%
Published
2022-07-25
Updated
2022-12-21
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
Source: Fedora Project
Max CVSS
6.1
EPSS Score
0.08%
Published
2021-11-22
Updated
2022-12-21
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
Source: Red Hat, Inc.
Max CVSS
6.5
EPSS Score
0.05%
Published
2022-09-29
Updated
2022-10-03
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.
Source: Red Hat, Inc.
Max CVSS
6.1
EPSS Score
0.07%
Published
2022-03-11
Updated
2022-11-07
In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.
Source: Red Hat, Inc.
Max CVSS
6.1
EPSS Score
0.10%
Published
2020-11-19
Updated
2020-12-03
In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.
Source: Red Hat, Inc.
Max CVSS
6.5
EPSS Score
0.13%
Published
2020-11-19
Updated
2020-12-03
A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8.
Source: Red Hat, Inc.
Max CVSS
6.1
EPSS Score
0.08%
Published
2020-12-08
Updated
2020-12-08
The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Source: Red Hat, Inc.
Max CVSS
6.1
EPSS Score
0.08%
Published
2020-12-08
Updated
2020-12-08
The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.
Source: Red Hat, Inc.
Max CVSS
6.1
EPSS Score
0.08%
Published
2020-12-09
Updated
2020-12-10
101 vulnerabilities found
1 2 3 4 5
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!