Page 3 of 365 results (0.002 seconds)

CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. • https://moodle.org/mod/forum/discuss.php?d=424806 • CWE-276: Incorrect Default Permissions CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. Moodle version 3.10.1 suffers from a remote time-based SQL injection vulnerability. • https://github.com/StackOverflowExcept1on/CVE-2021-36393 https://moodle.org/mod/forum/discuss.php?d=424798 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. • https://github.com/T0X1Cx/CVE-2021-36396-Exploit https://moodle.org/mod/forum/discuss.php?d=424802 • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0

In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. • https://moodle.org/mod/forum/discuss.php?d=424807 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0

In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. • https://moodle.org/mod/forum/discuss.php?d=424809 • CWE-912: Hidden Functionality •