Known vulnerabilities in Moodle - page 4

Vendor: moodle.org
Software: Moodle
Software CPE: cpe:2.3:a:moodle_org:moodle:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 618
Public exploits: 26
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Moodle Moodle is affected by 618 known vulnerabilities: 29 high, 250 medium, 338 low Critical High Medium Low

Vulnerabilities (618)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU124431 - Improper Access Control
CVE-2025-62438
CWE-284 Medium
No
No
4.1.20, 4.4.10, 4.5.6, 5.0.2 25.03.2026 SB2026032563
#VU124430 - Exposure of sensitive information to an unauthorized actor
CVE-2025-62437
CWE-200 Medium
No
No
4.1.20, 4.4.10, 4.5.6, 5.0.2 25.03.2026 SB2026032563
#VU124429 - Improper Access Control
CVE-2025-62436
CWE-284 Medium
No
No
4.1.20, 4.4.10, 4.5.6, 5.0.2 25.03.2026 SB2026032563
#VU111265 - Improper Access Control
CVE-2025-49518
CWE-284 Medium
No
No
4.1.19, 4.4.9, 4.5.5, 5.0.1 18.06.2025 SB2025061828
SB20250619210
SB20250619212
#VU111257 - Missing Authorization
CVE-2025-49517
CWE-862 Medium
No
No
4.1.19, 4.4.9, 4.5.5, 5.0.1 18.06.2025 SB2025061828
SB20250619210
SB20250619212
#VU111256 - Cross-Site Request Forgery (CSRF)
CVE-2025-49516
CWE-352 Low
No
No
4.1.19, 4.4.9, 4.5.5, 5.0.1 18.06.2025 SB2025061828
SB20250619210
SB20250619212
#VU111255 - Exposure of sensitive information to an unauthorized actor
CVE-2025-49515
CWE-200 Medium
No
No
4.1.19, 4.4.9, 4.5.5, 5.0.1 18.06.2025 SB2025061828
SB20250619210
SB20250619212
#VU111254 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-46337
CWE-89 High
No
No
4.1.19, 4.4.9, 4.5.5, 5.0.1 18.06.2025 SB2025061805
SB2025061811
SB2025061812
and 4 more
#VU111253 - Use of Cache Containing Sensitive Information
CVE-2025-49513
CWE-524 Low
No
No
4.1.19, 4.4.9, 4.5.5, 5.0.1 18.06.2025 SB2025061828
SB20250619210
SB20250619212
#VU111252 - Server-Side Request Forgery (SSRF)
CVE-2025-49514
CWE-918 Medium
No
No
4.1.19, 4.4.9, 4.5.5, 5.0.1 18.06.2025 SB2025061828
SB20250619210
SB20250619212
#VU111251 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49512
CWE-79 Low
No
No
5.0.1 18.06.2025 SB2025061828
#VU107641 - Improper Access Control
CVE-2025-3625
CWE-284 Medium
No
No
4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107640 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-40446
CWE-94 High
No
No
4.1.18, 4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107635 - Improper Authentication
CVE-2025-3627
CWE-287 Medium
No
No
4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107634 - Improper Access Control
CVE-2025-3647
CWE-284 Medium
No
No
4.1.18, 4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107633 - Improper Access Control
CVE-2025-3645
CWE-284 Medium
No
No
4.1.18, 4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107632 - Improper Access Control
CVE-2025-3644
CWE-284 Medium
No
No
4.1.18, 4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107629 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3643
CWE-79 Low
No
No
4.1.18, 4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107627 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-3642
CWE-94 Medium
No
No
4.1.18, 4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221
#VU107618 - Cross-Site Request Forgery (CSRF)
CVE-2025-3635
CWE-352 Low
No
No
4.1.18, 4.3.12, 4.4.8, 4.5.4 22.04.2025 SB2025042221


Showing elements 61 - 80 out of 618