CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4943
https://notcve.org/view.php?id=CVE-2006-4943
23 Sep 2006 — course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter. course/jumpto.php en Moodle anterior a 1.6.2 no valida la llave de sesión (sesskey) antes de proporcionar el contenido de URIs locales de su elección, que permite que atacantes remotos obtengan información sensible a través del parámetro jump. • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4784
https://notcve.org/view.php?id=CVE-2006-4784
14 Sep 2006 — Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) doc/index.php or (2) files/index.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Moodle 1.6.1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante parámetros no especificados para (1) dos/index.php o (2) files/index.php. • http://docs.moodle.org/en/Release_Notes#Moodle_1.6.2 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-4785
https://notcve.org/view.php?id=CVE-2006-4785
14 Sep 2006 — SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int. Vulnerabilidad de inyección SQL en el blog/edit.php del Moodle 1.6.1 y anteriores permite a atacantes remotos ejecutar comandos S... • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4786
https://notcve.org/view.php?id=CVE-2006-4786
14 Sep 2006 — Moodle 1.6.1 and earlier allows remote attackers to obtain sensitive information via (1) help.php and (2) other unspecified vectors involving scheduled backups. Moodle 1.6.1 y anteriores permite a atacantes remotos obtener información sensible mediante (1) help.php y (2) otros vectores no especificados relacionados con las copias de seguridad programadas. • http://docs.moodle.org/en/Release_Notes#Moodle_1.6.2 •
CVSS: 9.8EPSS: 8%CPEs: 8EXPL: 6CVE-2006-0146 – Simplog 0.9.2 - 's' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-0146
09 Jan 2006 — The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter. • https://www.exploit-db.com/exploits/1663 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 21%CPEs: 7EXPL: 5CVE-2006-0147 – Simplog 0.9.2 - 's' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-0147
09 Jan 2006 — Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo. • https://www.exploit-db.com/exploits/1663 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2005-3648
https://notcve.org/view.php?id=CVE-2005-3648
17 Nov 2005 — Multiple SQL injection vulnerabilities in the get_record function in datalib.php in Moodle 1.5.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) category.php and (2) info.php. Múltiples vulnerabilidades de inyección de SQL en la función get_record en datalib.php de Moodle 1.5.2 permite a atacantes remotos ejecutar órdenes SQL de su elección mediante el parámetro id en (1) category.php y (2) info.php. • http://marc.info/?l=bugtraq&m=113165668814241&w=2 •
CVSS: 6.5EPSS: 8%CPEs: 1EXPL: 2CVE-2005-3649 – Moodle 1.6dev - SQL Injection / Command Execution
https://notcve.org/view.php?id=CVE-2005-3649
17 Nov 2005 — jumpto.php in Moodle 1.5.2 allows remote attackers to redirect users to other sites via the jump parameter. jumto.php en Moodle 1.5.2 permite a atacantes remotos redirigir usuarios a otros sitios mediante el parámetro jump. • https://www.exploit-db.com/exploits/1312 •
CVSS: 10.0EPSS: 0%CPEs: 15EXPL: 0CVE-2005-2247
https://notcve.org/view.php?id=CVE-2005-2247
12 Jul 2005 — Multiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors. • http://moodle.org/doc/?frame=release.html •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 1CVE-2004-1424
https://notcve.org/view.php?id=CVE-2004-1424
31 Dec 2004 — Cross-site scripting (XSS) vulnerability in view.php in Moodle 1.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter. • http://marc.info/?l=bugtraq&m=110425409614735&w=2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •