A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
Max CVSS
6.5
EPSS Score
0.04%
Published
2024-03-21
Updated
2024-03-21
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."
Max CVSS
5.4
EPSS Score
0.05%
Published
2023-10-29
Updated
2024-03-21
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Max CVSS
6.3
EPSS Score
0.05%
Published
2023-06-22
Updated
2023-06-30
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-06-22
Updated
2023-06-30
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
Max CVSS
5.3
EPSS Score
1.66%
Published
2023-05-02
Updated
2023-05-11
Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.
Max CVSS
4.3
EPSS Score
0.06%
Published
2023-03-23
Updated
2023-04-07
Authenticated users were able to enumerate other users' names via the learning plans page.
Max CVSS
4.3
EPSS Score
0.05%
Published
2023-03-23
Updated
2023-03-28
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Max CVSS
6.1
EPSS Score
0.07%
Published
2023-03-23
Updated
2023-03-30
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
Max CVSS
6.1
EPSS Score
0.07%
Published
2023-03-23
Updated
2023-03-30
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Max CVSS
6.5
EPSS Score
0.07%
Published
2023-03-23
Updated
2023-03-30
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
Max CVSS
6.1
EPSS Score
0.12%
Published
2023-02-17
Updated
2023-02-28
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
Max CVSS
6.1
EPSS Score
0.12%
Published
2023-02-17
Updated
2023-02-28
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
Max CVSS
3.3
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-17
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Max CVSS
5.3
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-16
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
Max CVSS
5.3
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-16
The course upload preview contained an XSS risk for users uploading unsafe data.
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-15
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
Max CVSS
5.4
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-15
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
Max CVSS
5.3
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-16
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
Max CVSS
6.5
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-15
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.
Max CVSS
3.3
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-18
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
Max CVSS
4.3
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-16
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-11-09
Updated
2023-11-15
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Max CVSS
4.3
EPSS Score
0.06%
Published
2023-03-23
Updated
2023-03-30
The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Max CVSS
5.4
EPSS Score
0.11%
Published
2022-11-23
Updated
2023-01-31
A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.
Max CVSS
6.1
EPSS Score
0.10%
Published
2022-11-23
Updated
2023-01-31
431 vulnerabilities found
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!