Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Moodle Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2022-50943`Moodle LMS 4.0 Cross-Site Scripting via course search.php	Exploitation statusPublic exploit	FixNot confirmed	Affected productMoodle LMS	Published05/10/2026	SeverityMedium
`CVE-2026-26047`Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/21/2026	SeverityMedium
`CVE-2026-26046`Moodle: moodle: improper input sanitization in tex filter administration setting	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/21/2026	SeverityHigh
`CVE-2026-26045`Moodle: moodle: improper validation in file restore functionality leading to remote code execution	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/21/2026	SeverityHigh
`CVE-2025-67857`Moodle: moodle: data exposure of user identifiers in urls	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityMedium
`CVE-2025-67856`Moodle: moodle: privilege escalation via incomplete role checks in badge awarding	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityMedium
`CVE-2025-67855`Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityMedium
`CVE-2025-67853`Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email service	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityHigh
`CVE-2025-67852`Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityLow
`CVE-2025-67851`Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityMedium
`CVE-2025-67850`Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityHigh
`CVE-2025-67849`Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityHigh
`CVE-2025-67848`Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/03/2026	SeverityHigh
`CVE-2025-67847`Moodle: moodle: remote code execution via insufficient restore input validation	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published01/23/2026	SeverityHigh
`CVE-2021-47857`Moodle 3.10.3 - 'label' Persistent Cross Site Scripting	Exploitation statusPublic exploit	FixNot confirmed	Affected productMoodle	Published01/21/2026	SeverityMedium
`CVE-2025-62401`Moodle: possible to bypass timer in timed assignments	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-62395`Moodle: external cohort search service leaks system cohort data	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-62400`Moodle: hidden group names visible to event creators	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-62399`Moodle: password brute force risk when mobile/web services enabled	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityHigh
`CVE-2025-62398`Moodle: possible to bypass mfa	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-62397`Moodle: router produces json instead of 404 error for invalid course id	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-62396`Moodle: router (r.php) could expose application directories	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-62394`Moodle: quiz notifications sent to suspended participants	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-62393`Moodle: course access permissions not properly checked in course_output_fragment_course_overview	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published10/23/2025	SeverityMedium
`CVE-2025-34032`Moodle LMS Jmol Plugin Cross-site Scripting (XSS)	Exploitation statusPublic exploit	FixYes	Affected productJmol Plugin	Published06/24/2025	SeverityMedium
`CVE-2025-34031`Moodle LMS Jmol Plugin Path Traversal	Exploitation statusPublic exploit	FixYes	Affected productJmol Plugin	Published06/24/2025	SeverityHigh
`CVE-2025-53021`	Exploitation statusPublic exploit	FixNot confirmed	Affected productMoodle	Published06/24/2025	SeverityMedium
`CVE-2025-32045`Moodle: hidden grades shown to users without permission on some grade reports	Exploitation statusNot known exploited	FixNot confirmed	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-32044`Moodle: unauthenticated rest api user data exposure	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityHigh
`CVE-2025-3647`Moodle: idor when accessing the cohorts report	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3645`Moodle: idor in messaging web service allows access to some user details	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3644`Moodle: ajax section delete does not respect course_can_delete_section()	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3643`Moodle: reflected xss risk in policy tool	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3642`Moodle: authenticated remote code execution risk in the moodle lms equella repository	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityHigh
`CVE-2025-3641`Moodle: authenticated remote code execution risk in the moodle lms dropbox repository	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityHigh
`CVE-2025-3640`Moodle: idor in web service allows users enrolled in a course to access some details of other users	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3638`Moodle: csrf risk in brickfield tool's analysis request action	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityHigh
`CVE-2025-3637`Moodle: csrf token exposure via url in moodle mod_data module	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityLow
`CVE-2025-3636`Moodle: idor in moodle rss block allows unauthorized access to rss feeds	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3635`Moodle: csrf risk in moodle user tours manager allows tour duplication	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityLow
`CVE-2025-3628`Moodle: moodle assignment submission search leaks anonymous student identities	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3627`Moodle: partial data exposure in moodle before completing multi-factor authentication	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-3625`Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityHigh
`CVE-2025-3634`Moodle: moodle allows course self-enrolment before completing mfa	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published04/25/2025	SeverityMedium
`CVE-2025-26533`SQL injection risk in course search module list filter	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityHigh
`CVE-2025-26532`Teachers can evade trusttext config when restoring glossary entries	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityLow
`CVE-2025-26531`IDOR in badges allows disabling of arbitrary badges	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityLow
`CVE-2025-26530`Reflected XSS via question bank filter	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityHigh
`CVE-2025-26529`Stored XSS risk in admin live log	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityHigh
`CVE-2025-26528`Stored XSS in ddimageortext question type	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityLow
`CVE-2025-26527`Non-searchable tags can still be discovered on the tag search page and in the tags block	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityMedium
`CVE-2025-26526`Feedback response viewing and deletions did not respect Separate Groups mode	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityMedium
`CVE-2025-26525`Arbitrary file read risk through pdfTeX	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published02/24/2025	SeverityHigh
`CVE-2024-48899`Moodle: idor when accessing list of course badges	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/20/2024	SeverityMedium
`CVE-2024-45691`Moodle: lesson activity password bypass through php loose comparison	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/20/2024	SeverityMedium
`CVE-2024-45690`Moodle: idor when deleting oauth2 linked accounts	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/20/2024	SeverityHigh
`CVE-2024-45689`Moodle: unprotected access to sensitive information via dynamic tables	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/20/2024	SeverityMedium
`CVE-2024-48901`Moodle: idor when fetching report schedules	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/18/2024	SeverityMedium
`CVE-2024-48898`Moodle: some users can delete audiences of other reports	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/18/2024	SeverityMedium
`CVE-2024-48897`Moodle: idor in edit/delete rss feed	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/18/2024	SeverityMedium
`CVE-2024-48896`Moodle: users' names returned in messaging error message	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/18/2024	SeverityMedium
`CVE-2024-48900`Moodle: idor when accessing list of badge recipients	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/13/2024	SeverityMedium
`CVE-2024-43439`Moodle: reflected xss via h5p error message	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityMedium
`CVE-2024-43437`Moodle: xss risk when restoring malicious course backup file	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityMedium
`CVE-2024-43435`Moodle: can create global glossary without being admin	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityMedium
`CVE-2024-43433`Moodle: matrix user/power level management not always working as expected with suspended users	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityMedium
`CVE-2024-43432`Moodle: authorization headers preserved between "emulated redirects"	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityMedium
`CVE-2024-43430`Moodle: lack of access control when using external methods for quiz overrides	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityMedium
`CVE-2024-43429`Moodle: user information visibility control issues in gradebook reports	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityMedium
`CVE-2024-43427`Moodle: admin presets export tool includes some secrets that should not be exported	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/11/2024	SeverityLow
`CVE-2024-43440`Moodle: lfi vulnerability when restoring malformed block backups	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-43438`Moodle: idor in feedback non-respondents report allows messaging arbitrary site users	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-43436`Moodle: site administration sql injection via xmldb editor	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-43434`Moodle: csrf risk in feedback non-respondents report	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-43431`Moodle: idor in badges allows deletion of arbitrary badges	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-43428`Moodle: cache poisoning via injection into storage	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-43426`Moodle: arbitrary file read risk through pdftex	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-43425`Moodle: remote code execution via calculated question types	Exploitation statusNot known exploited	FixYes	Affected productmoodle	Published11/07/2024	SeverityHigh
`CVE-2024-34312`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/24/2024	SeverityMedium
`CVE-2024-37674`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/20/2024	SeverityMedium
`CVE-2024-38277`moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys	Exploitation statusNot known exploited	FixYes	Affected productMoodle	Published06/18/2024	SeverityMedium
`CVE-2024-38276`moodle: CSRF risks due to misuse of confirm_sesskey	Exploitation statusNot known exploited	FixYes	Affected productMoodle	Published06/18/2024	SeverityHigh
`CVE-2024-38275`moodle: HTTP authorization header is preserved between "emulated redirects"	Exploitation statusNot known exploited	FixYes	Affected productMoodle	Published06/18/2024	SeverityHigh
`CVE-2024-38274`moodle: stored XSS via calendar's event title when deleting the event	Exploitation statusNot known exploited	FixYes	Affected productMoodle	Published06/18/2024	SeverityMedium
`CVE-2024-38273`moodle: BigBlueButton web service leaks meeting joining information to users who should not have access	Exploitation statusNot known exploited	FixYes	Affected productMoodle	Published06/18/2024	SeverityMedium
`CVE-2024-34009`moodle: ReCAPTCHA can be bypassed on the login page	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityHigh
`CVE-2024-34008`moodle: CSRF risk in analytics management of models	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityLow
`CVE-2024-34007`moodle: logout CSRF in admin/tool/mfa/auth.php	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityHigh
`CVE-2024-34006`moodle: unsanitized HTML in site log for config_log_created	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-34005`moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-34004`moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-34003`moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-34002`moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-34001`moodle: CSRF risk in admin preset tool management of presets	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityHigh
`CVE-2024-34000`moodle: stored XSS in lesson overview report via user ID number	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-33999`moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php	Exploitation statusPublic exploit	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityCritical
`CVE-2024-33998`moodle: stored XSS via user's name on participants page when opening some options	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-33997`moodle: stored XSS risk when editing another user's equation in equation editor	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-33996`moodle: broken access control when setting calendar event type	Exploitation statusNot known exploited	FixNot confirmed	Affected productMoodle	Published05/31/2024	SeverityMedium
`CVE-2024-28593`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published03/22/2024	SeverityMedium

100 / 629 Results

Security vulnerabilities from Moodle

Moodle

Filters

Run an in-depth assessment with complete web risk management

Popular Moodle products

Moodle

Jmol Plugin

Moodle LMS