Moodle — система управления образовательными электронными курсами

Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

Moodle's mod_data edit/delete pages pass CSRF token in GET parameter

Moodle has a CSRF risk in user tours manager that allows tour duplication

Moodle's AJAX section delete does not respect course_can_delete_section()

Moodle has reflected Cross-site Scripting risk in policy tool

Moodle has an IDOR in messaging web service which allows access to some user details

Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository

Moodle shows hidden grades to users without permission on some grade reports

Moodle allows unauthenticated REST API user data exposure

Moodle self enrollment available before completing second factor with MFA enabled