| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website. |
| A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages. |
| A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks. |
| The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. |
| A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files. |
| A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk. |
| In Moodle 2.x and 3.x, SQL injection can occur via user preferences. |
| In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. |
| In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. |
| In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
| In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. |
| In Moodle 3.x, XSS can occur via evidence of prior learning. |
| In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. |
| Moodle 3.x has user fullname disclosure on the user preferences page. |
| In Moodle 3.2.x, global search displays user names for unauthenticated users. |
| In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. |
| Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
| In Moodle 3.x, there is XSS in the assignment submission page. |
| In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. |
| In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting. |
