Moodle Block Configurablereports
Approved changes feed: RSS · Atom
cpe:2.3:a:jleyva:moodle-block_configurablereports:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Jleyva (cccaa96e-672d-5f2a-9a3e-d9f95dc2f85a) |
|---|---|
| Product | Moodle Block Configurablereports (5cb3ca29-9193-5126-88db-5ef2df3918d0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-113607 |
vulnerable | 2026-11-03 10:16:27.963329 |
Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
MEDIUM (6.5)
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
Published: 2026-10-20T15:40:33.391Z
Updated: 2026-10-20T16:28:22.834Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113608 |
vulnerable | 2026-11-03 10:16:27.414174 |
Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var
MEDIUM (5.3)
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.
Published: 2026-10-20T15:40:34.083Z
Updated: 2026-10-21T15:54:21.518Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.