Moodle

Products

Exploited and recent CVEs

• CVE-2022-50943 Medium 6.1 Moodle LMS 4.0 Cross-Site Scripting via course search.php 0.3%
• CVE-2021-47857 High 7.2 Moodle 3.10.3 - 'label' Persistent Cross Site Scripting 0.4%
• CVE-2025-34032 Medium 5.1 Moodle LMS Jmol Plugin Cross-site Scripting (XSS) 0.8%
• CVE-2025-34031 High 8.7 Moodle LMS Jmol Plugin Path Traversal 3.1%
• CVE-2025-53021 Medium 4.2 A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication an 0.4%
• CVE-2024-38277 Medium 5.4 moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys 0.2%
• CVE-2024-38276 High 8.8 moodle: CSRF risks due to misuse of confirm_sesskey 0.5%
• CVE-2024-38275 High 7.5 moodle: HTTP authorization header is preserved between "emulated redirects" 0.4%
• CVE-2024-38274 Medium 6.1 moodle: stored XSS via calendar's event title when deleting the event 0.4%
• CVE-2024-38273 Medium 5.4 moodle: BigBlueButton web service leaks meeting joining information to users who should not have access 0.4%
• CVE-2024-33996 Medium 6.2 moodle: broken access control when setting calendar event type 0.4%
• CVE-2024-1439 Medium 6.5 Inadequate access control vulnerability in Moodle 0.3%