Approved changes feed: RSS · Atom
cpe:2.3:a:moodle_project:moodle:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Moodle Project (38b7332f-efeb-5b1f-8a63-b15de712dd6d) |
|---|---|
| Product | Moodle (07f6c8e6-3408-50e6-be9d-4c23d7ed4a66) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-119555 |
vulnerable | 2026-11-03 10:17:11.991552 |
Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback
MEDIUM (4.3)
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.
Published: 2026-10-30T11:31:05.504Z
Updated: 2026-11-05T21:20:47.007Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-119554 |
vulnerable | 2026-11-03 10:17:11.894719 |
Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber
MEDIUM (5.9)
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
Published: 2026-10-30T11:31:04.811Z
Updated: 2026-11-04T22:18:11.210Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-119556 |
vulnerable | 2026-11-03 10:17:11.848383 |
Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
MEDIUM (4.3)
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Published: 2026-10-30T11:31:06.200Z
Updated: 2026-10-30T15:54:25.966Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-119553 |
vulnerable | 2026-11-03 10:17:11.826931 |
Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
MEDIUM (6.5)
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Published: 2026-10-30T11:31:04.114Z
Updated: 2026-10-30T16:12:09.728Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26533 |
vulnerable | 2026-06-08 07:12:52.539810 |
SQL injection risk in course search module list filter
HIGH (8.1)
An SQL injection risk was identified in the module list filter within course search.
Published: 2025-02-24T20:07:44.582Z
Updated: 2025-02-25T14:35:34.040Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26532 |
vulnerable | 2026-06-08 07:12:52.539495 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26531 |
vulnerable | 2026-06-08 07:12:52.539097 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26530 |
vulnerable | 2026-06-08 07:12:52.538670 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26529 |
vulnerable | 2026-06-08 07:12:52.538261 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26528 |
vulnerable | 2026-06-08 07:12:52.537949 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26527 |
vulnerable | 2026-06-08 07:12:52.537625 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26526 |
vulnerable | 2026-06-08 07:12:52.537132 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26525 |
vulnerable | 2026-06-08 07:12:52.536025 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.