CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4936
https://notcve.org/view.php?id=CVE-2006-4936
23 Sep 2006 — Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and remote attack vectors. Moodle anterior a 1.6.2 no valida adecuadamente el modulo de instancia id cuando crea un objeto del módulo en curso, lo cual tiene un impacto no especificado y vectores remotos de ataque. • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4942
https://notcve.org/view.php?id=CVE-2006-4942
23 Sep 2006 — Moodle before 1.6.2, when the configuration lacks (1) algebra or (2) tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via (a) filter/algebra/pix.php or (b) filter/tex/pix.php. Moodle anterior a 1.6.2, cuando la configuración no tiene (1) algebra o (2) filtros de texto, permite a un usuario validado escribir ficheros de salida LaTex o MimeTex al nivel más alto del directorio dataroot a través de (a) filter/algebra/pix.php o (b) f... • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4939
https://notcve.org/view.php?id=CVE-2006-4939
23 Sep 2006 — backup/backup_scheduled.php in Moodle before 1.6.2 generates trace data with the full backup pathname even when debugging is disabled, which might allow attackers to obtain the pathname. backup/backup_scheduled.php en Moodle anterior a 1.6.2 genera un rastro de datos con el nombre de la ruta de la copia de seguridad siempre que el depurador se encuentre desactivado, lo cual podría permitir a un atacante obtener el nombre de la ruta. • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4786
https://notcve.org/view.php?id=CVE-2006-4786
14 Sep 2006 — Moodle 1.6.1 and earlier allows remote attackers to obtain sensitive information via (1) help.php and (2) other unspecified vectors involving scheduled backups. Moodle 1.6.1 y anteriores permite a atacantes remotos obtener información sensible mediante (1) help.php y (2) otros vectores no especificados relacionados con las copias de seguridad programadas. • http://docs.moodle.org/en/Release_Notes#Moodle_1.6.2 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-4785
https://notcve.org/view.php?id=CVE-2006-4785
14 Sep 2006 — SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int. Vulnerabilidad de inyección SQL en el blog/edit.php del Moodle 1.6.1 y anteriores permite a atacantes remotos ejecutar comandos S... • http://docs.moodle.org/en/Release_notes#Moodle_1.6.2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4784
https://notcve.org/view.php?id=CVE-2006-4784
14 Sep 2006 — Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) doc/index.php or (2) files/index.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Moodle 1.6.1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante parámetros no especificados para (1) dos/index.php o (2) files/index.php. • http://docs.moodle.org/en/Release_Notes#Moodle_1.6.2 •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 1CVE-2006-3951 – Mambo Component Mam-Moodle alpha - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-3951
01 Aug 2006 — PHP remote file inclusion vulnerability in moodle.php in Mam-moodle alpha component (com_moodle) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. Vulnerabilidad PHP de inclusión remota de archivo en moodle.php en el componente Mam-moodle alpha (com_moodle) para Mambo permite a atacantes remotos ejecutar código PHP de su elección a través de una URL en el parámetro mosConfig_absolute_path. • https://www.exploit-db.com/exploits/2064 •
CVSS: 9.8EPSS: 10%CPEs: 8EXPL: 6CVE-2006-0146 – Simplog 0.9.2 - 's' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-0146
09 Jan 2006 — The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter. • https://www.exploit-db.com/exploits/1663 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 3%CPEs: 7EXPL: 5CVE-2006-0147 – Simplog 0.9.2 - 's' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-0147
09 Jan 2006 — Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo. • https://www.exploit-db.com/exploits/1663 •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 2CVE-2005-3649 – Moodle 1.6dev - SQL Injection / Command Execution
https://notcve.org/view.php?id=CVE-2005-3649
17 Nov 2005 — jumpto.php in Moodle 1.5.2 allows remote attackers to redirect users to other sites via the jump parameter. jumto.php en Moodle 1.5.2 permite a atacantes remotos redirigir usuarios a otros sitios mediante el parámetro jump. • https://www.exploit-db.com/exploits/1312 •