Moodle vulnerabilities

CVEs per yearBy the year they were published

1. 201913
2. 20247
3. 20253
4. 20262

Newest CVEs

• CVE-2022-50943

  Moodle LMS 4.0 Cross-Site Scripting via course search.php

  Moodle · Moodle LMS

  Medium5.1
• CVE-2021-47857

  Moodle 3.10.3 - 'label' Persistent Cross Site Scripting

  Moodle · Moodle

  Medium5.1
• CVE-2025-34032

  Moodle LMS Jmol Plugin Cross-site Scripting (XSS)

  Moodle · Jmol Plugin

  Medium5.1
• CVE-2025-34031

  Moodle LMS Jmol Plugin Path Traversal

  Moodle · Jmol Plugin

  High8.7
• CVE-2025-53021

  A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey…

  Moodle · Moodle

  Medium4.2
• CVE-2024-38277

  moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys

  Moodle · Moodle

  Medium5.4
• CVE-2024-38276

  moodle: CSRF risks due to misuse of confirm_sesskey

  Moodle · Moodle

  High8.8
• CVE-2024-38275

  moodle: HTTP authorization header is preserved between "emulated redirects"

  Moodle · Moodle

  High7.5
• CVE-2024-38274

  moodle: stored XSS via calendar's event title when deleting the event

  Moodle · Moodle

  Medium6.1
• CVE-2024-38273

  moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

  Moodle · Moodle

  Medium5.4