Moodle — система управления образовательными электронными курсами

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. (Note: This does not affect sites with a forced URL scheme configured, mobile service disabled, or where the mobile app login method is "via the app").

A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.

SQL injection in moodle

Exposure of Sensitive Information in moodle

Incorrect Calculation in moodle

External Control of Assumed-Immutable Web Parameter in moodle

Cross-site Scripting in moodle

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.

A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.