Moodle — система управления образовательными электронными курсами

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

Moodle vulnerable to Cross-site Scripting

Moodle may allow teachers to access the names of users they could not otherwise access

Moodle vulnerable to Cross-site Request Forgery

Moodle may allow authenticated users to enumerate other user's names via learning plans page

Moodle may display roles to users who don't have access to them

Moodle arbitrary file read vulnerability

Moodle SQL Injection vulnerability

Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional