Moodle — система управления образовательными электронными курсами

Уязвимость виртуальной обучающей среды moodle, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код и раскрыть защищаемую информацию

Уязвимость виртуальной обучающей среды Moodle, связанная с неправильной проверкой входных данных, позволяющая нарушителю выполнить произвольный код

Moodle Persistent Cross-site Scripting (XSS)

Moodle contains CSRF vulnerability

Moodle Insecure direct object reference (IDOR) in a calendar web service

Moodle command execution vulnerability exists in the default legacy spellchecker plugin

Moodle Cross Site Scripting (XSS)

A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions.

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").

A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.