Moodle — система управления образовательными электронными курсами

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

The referrer URL used by MFA required additional sanitizing, rather than being used directly.

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

Moodle CSRF risk in analytics management of models