Known vulnerabilities in Moodle

Vendor: moodle.org
Software: Moodle
Software CPE: cpe:2.3:a:moodle_org:moodle:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 605
Public exploits: 26
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Moodle Moodle is affected by 605 known vulnerabilities: 28 high, 241 medium, 335 low Critical High Medium Low

Vulnerabilities (605)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135065 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135064 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135063 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135062 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135061 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135060 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135059 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135058 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135057 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135056 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135055 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135054 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135050 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135049 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135048 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135047 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135046 - Improper input validation
CWE-20 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135034 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU128465 - Cross-Site Request Forgery (CSRF)
CVE-2026-7277
CWE-352 Low
No
No
5.0.7, 5.1.4 29.04.2026 SB2026042965
#VU128462 - Cross-Site Request Forgery (CSRF)
CVE-2026-7278
CWE-352 Low
No
No
4.5.11, 5.0.7, 5.1.4 29.04.2026 SB2026042965


Showing elements 1 - 20 out of 605