Known vulnerabilities in Moodle

Vendor: moodle.org
Software: Moodle
Software CPE: cpe:2.3:a:moodle_org:moodle:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 618
Public exploits: 26
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Moodle Moodle is affected by 618 known vulnerabilities: 29 high, 250 medium, 338 low Critical High Medium Low

Vulnerabilities (618)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151685 - Insufficient Logging
CWE-778 Medium
No
No
4.5.14, 5.0.10, 5.1.7, 5.2.3 23.09.2026 SB2026092325
#VU151684 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
4.5.14, 5.0.10, 5.1.7, 5.2.3 23.09.2026 SB2026092325
#VU148895 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148894 - Missing Authorization
CWE-862 Medium
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148893 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148892 - Missing Authorization
CWE-862 Medium
No
No
5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148891 - Missing Authorization
CWE-862 Medium
No
No
5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148890 - Missing Authorization
CWE-862 Medium
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148889 - Missing Authorization
CWE-862 Medium
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148888 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148887 - Improper Access Control
CWE-284 Medium
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148876 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 High
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU148875 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
4.5.13, 5.0.9, 5.1.6, 5.2.2 10.09.2026 SB2026091034
#VU135065 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135064 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135063 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135062 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135061 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135060 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135034 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340


Showing elements 1 - 20 out of 618