Log in Start free

Vulnerability · Published Sep 30, 2026 · Assigned by fedora

CVE-2026-102578Moodle: sql injection in question bank web service

Medium 5.5

In plain English

A medium-severity SQL injection in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Affected products (as reported)

VendorProductVersions
moodle 5.2.0 – before 5.2.25.1.0 – before 5.1.65.0.0 – before 5.0.90 – before 4.5.13

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

References