Moodle — система управления образовательными электронными курсами

Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. Attackers can craft a calendar event with malicious JavaScript in the subtitle track label to execute arbitrary code when users view the event.

Moodle 3.10.3 contains a persistent cross-site scripting vulnerability ...

Уязвимость виртуальной обучающей среды Moodle, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код и скомпрометировать систему

Moodle vulnerable to brute-force password guesses

Moodle exposed the names of hidden groups to users

Moodle's error handling leads to sensitive information disclosure

Moodle has a time restriction bypass

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

Moodle does not properly enforce MFA

Moodle course access permissions are not properly checked in course_output_fragment_course_overview