CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36401
https://notcve.org/view.php?id=CVE-2021-36401
06 Mar 2023 — In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. • https://moodle.org/mod/forum/discuss.php?d=424807 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36397
https://notcve.org/view.php?id=CVE-2021-36397
06 Mar 2023 — In Moodle, insufficient capability checks meant message deletions were not limited to the current user. • https://moodle.org/mod/forum/discuss.php?d=424803 • CWE-276: Incorrect Default Permissions •
CVSS: 10.0EPSS: 20%CPEs: 3EXPL: 2CVE-2021-36394
https://notcve.org/view.php?id=CVE-2021-36394
06 Mar 2023 — In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. • https://github.com/dinhbaouit/CVE-2021-36394 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-384: Session Fixation •
CVSS: 10.0EPSS: 26%CPEs: 3EXPL: 2CVE-2021-36393 – Moodle 3.10.1 SQL Injection
https://notcve.org/view.php?id=CVE-2021-36393
06 Mar 2023 — In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. Moodle version 3.10.1 suffers from a remote time-based SQL injection vulnerability. • https://packetstorm.news/files/id/178051 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-36396
https://notcve.org/view.php?id=CVE-2021-36396
06 Mar 2023 — In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. • https://github.com/T0X1Cx/CVE-2021-36396-Exploit • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23923 – Moodle: possible to set the preferred "start page" of other users
https://notcve.org/view.php?id=CVE-2023-23923
17 Feb 2023 — The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76862 • CWE-284: Improper Access Control •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2023-23921 – Moodle: reflected xss risk in some returnurl parameters
https://notcve.org/view.php?id=CVE-2023-23921
17 Feb 2023 — The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.4EPSS: 0%CPEs: 7EXPL: 0CVE-2022-45152
https://notcve.org/view.php?id=CVE-2022-45152
25 Nov 2022 — A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-45151
https://notcve.org/view.php?id=CVE-2022-45151
23 Nov 2022 — The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website. La vulnerabilidad XSS almacenada se descubrió en Moodle y existe debido a una sanitización insuficiente de los datos proporcionados por el usuario en varios campos de perfil de usuario "social". Un atacante podría inyectar y ejec... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76131 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-45149
https://notcve.org/view.php?id=CVE-2022-45149
23 Nov 2022 — A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks. Se encontró una vulnerabilidad... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75862 • CWE-352: Cross-Site Request Forgery (CSRF) •