Moodle LMS 4.0 Cross-Site Scripting via course search.php

Moodle 3.10.3 - 'label' Persistent Cross Site Scripting

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the…

Moodle: idor when deleting oauth2 linked accounts

Moodle: reflected xss via h5p error message

Moodle: can create global glossary without being admin

Moodle: matrix user/power level management not always working as expected with suspended users

Moodle: authorization headers preserved between "emulated redirects"

Moodle: lack of access control when using external methods for quiz overrides

Moodle: user information visibility control issues in gradebook reports

Moodle: lfi vulnerability when restoring malformed block backups

Moodle: idor in feedback non-respondents report allows messaging arbitrary site users

Moodle: site administration sql injection via xmldb editor

Moodle: csrf risk in feedback non-respondents report

Moodle: idor in badges allows deletion of arbitrary badges

Moodle: cache poisoning via injection into storage

Moodle: arbitrary file read risk through pdftex

Moodle: remote code execution via calculated question types

Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys

moodle: CSRF risks due to misuse of confirm_sesskey

moodle: HTTP authorization header is preserved between "emulated redirects"

moodle: stored XSS via calendar's event title when deleting the event

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

moodle: ReCAPTCHA can be bypassed on the login page

moodle: logout CSRF in admin/tool/mfa/auth.php

moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup

moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup

moodle: CSRF risk in admin preset tool management of presets

moodle: broken access control when setting calendar event type