Moodle — система управления образовательными электронными курсами

In Moodle, insufficient capability checks meant message deletions were not limited to the current user.

In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.

In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.

Moodle SQL Injection vulnerability

Moodle Session Fixation vulnerability

Moodle vulnerable to Server-Side Request Forgery

Moodle vulnerable to Uncontrolled Resource Consumption

Moodle SQL Injection vulnerability

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.