Known vulnerabilities in Moodle - page 2

Vendor: moodle.org
Software: Moodle
Software CPE: cpe:2.3:a:moodle_org:moodle:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 605
Public exploits: 26
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Moodle Moodle is affected by 605 known vulnerabilities: 28 high, 241 medium, 335 low Critical High Medium Low

Vulnerabilities (605)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU128464 - Improper input validation
CVE-2026-7276
CWE-20 Medium
No
No
4.5.11, 5.0.7, 5.1.4 29.04.2026 SB2026042965
#VU128463 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-7275
CWE-94 High
No
No
4.5.11, 5.0.7, 5.1.4 29.04.2026 SB2026042965
#VU126452 - Deserialization of Untrusted Data
CVE-2026-24765
CWE-502 Low
No
No
4.5.11 17.04.2026 SB2026041791
SB2026041796
SB2026041797
and 3 more
#VU124638 - Resource exhaustion
CVE-2026-26047
CWE-400 Medium
No
No
4.5.9, 5.0.5, 5.1.2 26.03.2026 SB2026032641
#VU124637 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-26046
CWE-78 Low
No
No
4.5.9, 5.0.5, 5.1.2 26.03.2026 SB2026032641
#VU124635 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-26045
CWE-94 Low
No
No
4.5.9, 5.0.5, 5.1.2 26.03.2026 SB2026032641
#VU124634 - Insertion of Sensitive Information Into Sent Data
CVE-2025-67857
CWE-201 Medium
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124633 - Improper Authorization
CVE-2025-67856
CWE-285 Medium
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124632 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-67855
CWE-79 Low
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124631 - Improper Access Control
CVE-2025-67854
CWE-284 Medium
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124630 - Improper Restriction of Excessive Authentication Attempts
CVE-2025-67853
CWE-307 Medium
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124629 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2025-67852
CWE-601 Medium
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124628 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-67850
CWE-79 Low
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124626 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-67849
CWE-79 Low
No
No
4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124625 - Improper Handling of Insufficient Permissions or Privileges
CVE-2025-67848
CWE-280 Medium
No
No
4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1 26.03.2026 SB2026032640
#VU124455 - Improper Authentication
CVE-2025-62398
CWE-287 Medium
No
No
4.4.11, 4.5.7, 5.0.3 25.03.2026 SB2026032565
SB2026032621
SB2026032622
and 1 more
#VU124441 - Information Exposure Through an Error Message
CVE-2025-62397
CWE-209 Medium
No
No
5.0.3 25.03.2026 SB2026032565
SB2026032621
#VU124440 - Exposure of Information Through Directory Listing
CVE-2025-62396
CWE-548 Medium
No
No
4.5.7, 5.0.3 25.03.2026 SB2026032565
SB2026032621
SB2026032622
#VU124432 - Improper Access Control
CVE-2025-62393
CWE-284 Medium
No
No
5.0.3 25.03.2026 SB2026032565
SB2026032621
#VU120184 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2025-14761
CWE-451 Low
No
No
4.5.11, 5.0.7, 5.1.4 18.12.2025 SB2025121803
SB2026012015
SB2026012016
and 2 more


Showing elements 21 - 40 out of 605