CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36401
https://notcve.org/view.php?id=CVE-2021-36401
06 Mar 2023 — In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. • https://moodle.org/mod/forum/discuss.php?d=424807 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36397
https://notcve.org/view.php?id=CVE-2021-36397
06 Mar 2023 — In Moodle, insufficient capability checks meant message deletions were not limited to the current user. • https://moodle.org/mod/forum/discuss.php?d=424803 • CWE-276: Incorrect Default Permissions •
CVSS: 10.0EPSS: 20%CPEs: 3EXPL: 2CVE-2021-36394
https://notcve.org/view.php?id=CVE-2021-36394
06 Mar 2023 — In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. • https://github.com/dinhbaouit/CVE-2021-36394 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-384: Session Fixation •
CVSS: 10.0EPSS: 26%CPEs: 3EXPL: 2CVE-2021-36393 – Moodle 3.10.1 SQL Injection
https://notcve.org/view.php?id=CVE-2021-36393
06 Mar 2023 — In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. Moodle version 3.10.1 suffers from a remote time-based SQL injection vulnerability. • https://packetstorm.news/files/id/178051 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36400
https://notcve.org/view.php?id=CVE-2021-36400
06 Mar 2023 — In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. • https://moodle.org/mod/forum/discuss.php?d=424806 • CWE-276: Incorrect Default Permissions CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-36396
https://notcve.org/view.php?id=CVE-2021-36396
06 Mar 2023 — In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. • https://github.com/T0X1Cx/CVE-2021-36396-Exploit • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23923 – Moodle: possible to set the preferred "start page" of other users
https://notcve.org/view.php?id=CVE-2023-23923
17 Feb 2023 — The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76862 • CWE-284: Improper Access Control •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23921 – Moodle: reflected xss risk in some returnurl parameters
https://notcve.org/view.php?id=CVE-2023-23921
17 Feb 2023 — The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.4EPSS: 0%CPEs: 7EXPL: 0CVE-2022-45152
https://notcve.org/view.php?id=CVE-2022-45152
25 Nov 2022 — A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-45151
https://notcve.org/view.php?id=CVE-2022-45151
23 Nov 2022 — The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website. La vulnerabilidad XSS almacenada se descubrió en Moodle y existe debido a una sanitización insuficiente de los datos proporcionados por el usuario en varios campos de perfil de usuario "social". Un atacante podría inyectar y ejec... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76131 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •