CVEs we hold for Moodle

Records whose assigning authority named Moodle as the affected vendor. Newest identifiers first, capped at 200.

CVE-2025-53021no title heldMoodle

CVE-2025-34032Moodle LMS Jmol Plugin Cross-site Scripting (XSS)Moodle Jmol Plugin

CVE-2025-34031Moodle LMS Jmol Plugin Path TraversalMoodle Jmol Plugin

CVE-2025-26533SQL injection risk in course search module list filtermoodle

CVE-2025-26532Teachers can evade trusttext config when restoring glossary entriesmoodle

CVE-2025-26531IDOR in badges allows disabling of arbitrary badgesmoodle

CVE-2025-26530Reflected XSS via question bank filtermoodle

CVE-2025-26529Stored XSS risk in admin live logmoodle

CVE-2025-26528Stored XSS in ddimageortext question typemoodle

CVE-2025-26527Non-searchable tags can still be discovered on the tag search page and in the tags blockmoodle

CVE-2025-26526Feedback response viewing and deletions did not respect Separate Groups modemoodle

CVE-2025-26525Arbitrary file read risk through pdfTeXmoodle

CVE-2024-38277moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keysMoodle

CVE-2024-38276moodle: CSRF risks due to misuse of confirm_sesskeyMoodle

CVE-2024-38275moodle: HTTP authorization header is preserved between "emulated redirects"Moodle

CVE-2024-38274moodle: stored XSS via calendar's event title when deleting the eventMoodle

CVE-2024-38273moodle: BigBlueButton web service leaks meeting joining information to users who should not have accessMoodle

CVE-2024-33996moodle: broken access control when setting calendar event typeMoodle

CVE-2024-1439Inadequate access control vulnerability in MoodleMoodle LMS

CVE-2022-50943Moodle LMS 4.0 Cross-Site Scripting via course search.phpMoodle LMS

CVE-2022-45152no title heldn/a Moodle

CVE-2022-45151no title heldn/a Moodle

CVE-2022-45150no title heldn/a Moodle

CVE-2022-45149no title heldn/a Moodle

CVE-2022-40316no title heldn/a moodle

CVE-2022-40315no title heldn/a moodle

CVE-2022-40314no title heldn/a moodle

CVE-2022-40313no title heldn/a moodle

CVE-2022-40208no title heldn/a Moodle

CVE-2022-39183Moodle Plugin - SAML Auth Open RedirectMoodle Plugin - SAML Auth

CVE-2022-35653no title heldn/a Moodle

CVE-2022-35652no title heldn/a Moodle

CVE-2022-35651no title heldn/a Moodle

CVE-2022-35650no title heldn/a Moodle

CVE-2022-35649no title heldn/a Moodle

CVE-2022-30600no title heldn/a moodle

CVE-2022-30599no title heldn/a moodle

CVE-2022-30598no title heldn/a moodle

CVE-2022-30597no title heldn/a moodle

CVE-2022-30596no title heldn/a moodle

CVE-2022-2986no title heldn/a moodle

CVE-2022-0985no title heldn/a moodle

CVE-2022-0984no title heldn/a moodle

CVE-2022-0983no title heldn/a moodle

CVE-2022-0335no title heldn/a moodle

CVE-2022-0334no title heldn/a moodle

CVE-2022-0333no title heldn/a moodle

CVE-2022-0332no title heldn/a moodle

CVE-2021-47857Moodle 3.10.3 - 'label' Persistent Cross Site ScriptingMoodle

CVE-2021-43560no title heldn/a moodle

CVE-2021-43559no title heldn/a moodle

CVE-2021-43558no title heldn/a moodle

CVE-2021-40695no title heldn/a moodle

CVE-2021-40694no title heldn/a moodle

CVE-2021-40693no title heldn/a moodle

CVE-2021-40692no title heldn/a moodle

CVE-2021-40691no title heldn/a moodle

CVE-2021-3943no title heldn/a moodle

CVE-2021-36403no title heldn/a Moodle

CVE-2021-36402no title heldn/a Moodle

CVE-2021-36401no title heldn/a Moodle

CVE-2021-36400no title heldn/a Moodle

CVE-2021-36399no title heldn/a Moodle

CVE-2021-36398no title heldn/a Moodle

CVE-2021-36397no title heldn/a Moodle

CVE-2021-36396no title heldn/a Moodle

CVE-2021-36395no title heldn/a Moodle

CVE-2021-36394no title heldn/a Moodle

CVE-2021-36393no title heldn/a Moodle

CVE-2021-36392no title heldn/a Moodle

CVE-2021-32478no title heldn/a moodle

CVE-2021-32477no title heldn/a moodle

CVE-2021-32476no title heldn/a moodle

CVE-2021-32475no title heldn/a moodle

CVE-2021-32474no title heldn/a moodle

CVE-2021-32473no title heldn/a moodle

CVE-2021-32472no title heldn/a moodle

CVE-2021-21809no title heldn/a Moodle

CVE-2021-20283no title heldn/a moodle

CVE-2021-20282no title heldn/a moodle

CVE-2021-20281no title heldn/a moodle

CVE-2021-20280no title heldn/a moodle

CVE-2021-20279no title heldn/a moodle

CVE-2021-20187no title heldn/a moodle

CVE-2021-20186no title heldn/a moodle

CVE-2021-20185no title heldn/a moodle

CVE-2021-20184no title heldn/a moodle

CVE-2021-20183no title heldn/a moodle

CVE-2020-36633moodle-block_sitenews block_sitenews.php get_content cross-site request forgeryn/a moodle-block_sitenews

CVE-2020-25703no title heldn/a moodle

CVE-2020-25702no title heldn/a moodle

CVE-2020-25701no title heldn/a moodle

CVE-2020-25700no title heldn/a moodle

CVE-2020-25699no title heldn/a moodle

CVE-2020-25698no title heldn/a moodle

CVE-2020-25631no title heldn/a Moodle

CVE-2020-25630no title heldn/a Moodle

CVE-2020-25629no title heldn/a Moodle

CVE-2020-25628no title heldn/a Moodle

CVE-2020-25627no title heldn/a Moodle

CVE-2020-1756no title heldn/a Moodle

CVE-2020-1755no title heldn/a Moodle

CVE-2020-1754no title heldn/a Moodle

CVE-2020-1691no title heldn/a Moodle

CVE-2020-14322no title heldn/a Moodle

CVE-2020-14321no title heldn/a Moodle

CVE-2020-14320no title heldn/a Moodle

CVE-2019-14831no title heldn/a Moodle

CVE-2019-14830no title heldn/a Moodle

CVE-2019-14829no title heldn/a Moodle

CVE-2019-14828no title heldn/a Moodle

CVE-2019-14827no title heldn/a Moodle

CVE-2019-10154no title heldmoodle

CVE-2019-10134no title heldmoodle

CVE-2019-10133no title heldmoodle

CVE-2018-1137no title heldn/a Moodle 3.x unknown

CVE-2018-1136no title heldn/a Moodle 3.x unknown

CVE-2018-1135no title heldn/a Moodle 3.x unknown

CVE-2018-1134no title heldn/a Moodle 3.x unknown

CVE-2018-1133no title heldn/a Moodle 3.x unknown

CVE-2018-1045no title heldn/a Moodle 3.x

CVE-2018-1044no title heldn/a Moodle 3.x

CVE-2018-1043no title heldn/a Moodle 3.x

CVE-2018-1042no title heldn/a Moodle 3.x

CVE-2017-7491no title heldn/a Moodle 2.x and 3.x

CVE-2017-7490no title heldn/a Moodle 2.x and 3.x

CVE-2017-7489no title heldn/a Moodle 2.x and 3.x

CVE-2017-2645no title heldn/a Moodle 3.x

CVE-2017-2644no title heldn/a Moodle 3.x

CVE-2017-2643no title heldn/a Moodle 3.2.x

CVE-2017-2641no title heldn/a Moodle 2.x and 3.x

CVE-2017-2578no title heldn/a Moodle 3.x

CVE-2017-2576no title heldn/a Moodle 2.x and 3.x

CVE-2017-15110no title heldn/a Moodle 3.x

CVE-2017-12157no title heldn/a Moodle 3.x

CVE-2017-12156no title heldn/a Moodle 3.x

CVE-2016-8644no title heldn/a Moodle 2.x and 3.x

CVE-2016-8643no title heldn/a Moodle 2.x and 3.x

CVE-2016-8642no title heldn/a Moodle 2.x and 3.x

CVE-2016-7038no title heldn/a Moodle 2.x and 3.x

CVE-2012-1170no title heldMoodle

CVE-2012-1169no title heldMoodle

CVE-2012-1168no title heldMoodle

CVE-2012-1161no title heldMoodle

CVE-2012-1160no title heldMoodle

CVE-2012-1159no title heldMoodle

CVE-2012-1158no title heldMoodle

CVE-2012-1157no title heldMoodle

CVE-2012-1156no title heldMoodle

CVE-2012-1155no title heldMoodle

150 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.