Known vulnerabilities in Moodle - page 2

Vendor: moodle.org
Software: Moodle
Software CPE: cpe:2.3:a:moodle_org:moodle:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 618
Public exploits: 26
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Moodle Moodle is affected by 618 known vulnerabilities: 29 high, 250 medium, 338 low Critical High Medium Low

Vulnerabilities (618)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135059 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135058 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135057 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135056 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135055 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135054 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135050 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135049 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135048 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135047 - Improper Access Control
CWE-284 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU135046 - Improper input validation
CWE-20 Medium
No
No
4.5.12, 5.0.8, 5.1.5, 5.2.1 23.06.2026 SB2026062340
#VU128465 - Cross-Site Request Forgery (CSRF)
CVE-2026-7277
CWE-352 Low
No
No
5.0.7, 5.1.4 29.04.2026 SB2026042965
#VU128464 - Improper input validation
CVE-2026-7276
CWE-20 Medium
No
No
4.5.11, 5.0.7, 5.1.4 29.04.2026 SB2026042965
#VU128463 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-7275
CWE-94 High
No
No
4.5.11, 5.0.7, 5.1.4 29.04.2026 SB2026042965
#VU128462 - Cross-Site Request Forgery (CSRF)
CVE-2026-7278
CWE-352 Low
No
No
4.5.11, 5.0.7, 5.1.4 29.04.2026 SB2026042965
#VU126452 - Deserialization of Untrusted Data
CVE-2026-24765
CWE-502 Low
No
No
4.5.11 17.04.2026 SB2026041791
SB2026041796
SB2026041797
and 3 more
#VU124638 - Resource exhaustion
CVE-2026-26047
CWE-400 Medium
No
No
4.5.9, 5.0.5, 5.1.2 26.03.2026 SB2026032641
#VU124637 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-26046
CWE-78 Low
No
No
4.5.9, 5.0.5, 5.1.2 26.03.2026 SB2026032641
#VU124635 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-26045
CWE-94 Low
No
No
4.5.9, 5.0.5, 5.1.2 26.03.2026 SB2026032641
#VU120184 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2025-14761
CWE-451 Low
No
No
4.5.11, 5.0.7, 5.1.4 18.12.2025 SB2025121803
SB2026012015
SB2026012016
and 2 more


Showing elements 21 - 40 out of 618