Moodle vulnerabilities
We track 33 vulnerabilities in Moodle products across 2 products. 33 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest Moodle vulnerabilities
- 8.8 High severity
Moodle: Improper Neutralization of Special Elements used in an SQL Command
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an at
- 7.2 High severity
Moodle: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting v
- 7.2 High severity
Moodle: Improper Control of Generation of Code
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore
- 9.8 Critical severity
Moodle: Incorrect Authorization
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper verification. This could enable unauthorized users to obtain badges they are not
- 7.5 High severity
Moodle: Improper Restriction of Excessive Authentication Attempts
A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user
- 7.8 High severity
Moodle: Improper Neutralization of Formula Elements in a CSV File
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary fo
- 8.1 High severity
Moodle: Improper Handling of Insufficient Permissions or Privileges
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspensi
- 8.8 High severity
Moodle: Improper Control of Generation of Code
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Succ
- 7.5 High severity
Moodle: Improper Restriction of Excessive Authentication Attempts
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
- 7.5 High severity
Jmol Plugin: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbi
- 8.8 High severity
Moodle: Improper Control of Generation of Code
A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.
- 8.8 High severity
Moodle: Improper Control of Generation of Code
A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.
- 8.8 High severity
Moodle: Cross-Site Request Forgery
A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk.
- 7.1 High severity
Moodle: Authorization Bypass Through User-Controlled Key
A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).
- 7.5 High severity
Moodle: Exposure of Sensitive Information to an Unauthorized Actor
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with ze
- 7.5 High severity
moodle: Authorization Bypass Through User-Controlled Key
A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.
- 8.1 High severity
moodle: Improper Limitation of a Pathname to a Restricted Directory
The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.
- 7.5 High severity
moodle: Improper Validation of Specified Type of Input
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
- 8.1 High severity
moodle: Improper Control of Generation of Code
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
- 7.5 High severity
Moodle: Incomplete Cleanup
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
- 7.5 High severity
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the…
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.
- 9.8 Critical severity
moodle: Improper Control of Generation of Code
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
- 7.5 High severity
Moodle: Server-Side Request Forgery
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
- 7.3 High severity
Moodle: Improper Neutralization of Special Elements used in an SQL Command
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL command
- 9.8 Critical severity
Moodle: Improper Control of Generation of Code
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
- 8.8 High severity
moodle: Improper Neutralization of Special Elements used in an SQL Command
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
- 8.2 High severity
Moodle: Improper Access Control
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise rest
- 9.1 Critical severity
Moodle: Server-Side Request Forgery
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind S
- 7.5 High severity
The vulnerability was found in Moodle, occurs due to input validation error when importing…
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks.
- 9.8 Critical severity
The vulnerability was found in Moodle, occurs due to improper input validation when parsing…
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation
- 8.8 High severity
moodle: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- 8.8 High severity
moodle: Cross-Site Request Forgery
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
- 9.8 Critical severity
moodle: Improper Neutralization of Special Elements used in an SQL Command
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.