Moodle Mod Customcert
Approved changes feed: RSS · Atom
cpe:2.3:a:mdjnelson:moodle-mod_customcert:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mdjnelson (d78bc642-907e-5927-9e51-d845e98937a8) |
|---|---|
| Product | Moodle Mod Customcert (0894e6cc-d713-5b9f-ae4d-bbf58f642ad1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-30884 |
vulnerable | 2026-06-08 07:57:14.430997 |
mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key
CRITICAL (9.6)
mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds `mod/customcert:manage` in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The `core_get_fragment` callback `editelement` and the `mod_customcert_save_element` web service both fail to verify that the supplied `elementid` belongs to the authorized context, enabling cross-course information disclosure and data tampering. Versions 4.4.9 and 5.0.3 fix the issue.
Published: 2026-03-18T02:26:30.420Z
Updated: 2026-03-18T19:17:40.756Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.