Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119554Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber
Medium 5.9
In plain English
A medium-severity SQL injection in moodle from Moodle Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Moodle Project | moodle | 5.3.05.2.0 – through 5.2.45.1.0 – through 5.1.85.0.0 – through 5.0.110 – through 4.5.15 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-L926 technical-description
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-L979 technical-description
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-L528 technical-description
- https://abraxaslabs.tech/research/moodle-enrol-database-sqli third-party-advisory
- https://github.com/moodle/moodle product
- VulnCheck Advisory: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber third-party-advisory