Moodle — система управления образовательными электронными курсами

Moodle's AJAX section delete does not respect course_can_delete_section()

Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

Moodle has a CSRF risk in Brickfield tool's analysis request action

Moodle has an IDOR in messaging web service which allows access to some user details

Moodle makes some user data available before completing second factor with MFA enabled

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

Moodle self enrollment available before completing second factor with MFA enabled

Moodle shows hidden grades to users without permission on some grade reports

Moodle reveals student identities through assignment submissions search on anonymous submissions

Moodle allows unauthenticated REST API user data exposure