Moodle Project moodle
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-119556 | 5.3.0 ; 5.2.0 – 5.2.4 ; 5.1.0 – 5.1.8 ; … | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-119555 | 5.3.0 ; 5.2.0 – 5.2.4 ; 5.1.0 – 5.1.8 ; … | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-119554 | 5.3.0 ; 5.2.0 – 5.2.4 ; 5.1.0 – 5.1.8 ; … | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-119553 | 5.3.0 ; 5.2.0 – 5.2.4 ; 5.1.0 – 5.1.8 ; … | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal | HIGH 7.1 | 0.4 % | ||
| CVE-2025-26533 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | SQL injection risk in course search module list filter | CRITICAL 9.8 | 0.6 % | ||
| CVE-2025-26532 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | Teachers can evade trusttext config when restoring glossary entries | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-26531 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | IDOR in badges allows disabling of arbitrary badges | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-26530 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 | Reflected XSS via question bank filter | HIGH 8.3 | 0.4 % | ||
| CVE-2025-26529 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | Stored XSS risk in admin live log | HIGH 8.3 | 0.5 % | ||
| CVE-2025-26528 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | Stored XSS in ddimageortext question type | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-26527 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | Non-searchable tags can still be discovered on the tag search page and in the tags block | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-26526 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | Feedback response viewing and deletions did not respect Separate Groups mode | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-26525 | 4.5.0 – < 4.5.2 ; 4.4.0 – < 4.4.6 ; 4.3.0 – < 4.3.10 ; … | Arbitrary file read risk through pdfTeX | HIGH 8.6 | 0.4 % |