Moodle — система управления образовательными электронными курсами

Moodle attackers to modify grade metadata

Moodle creates a MoodleMobile web-service token with an infinite lifetime

Moodle allows attackers to modify the visibility of a badge

Moodle places a session key in a URL

Moodle does not properly restrict access

Moodle allows attackers to obtain sensitive information

Moodle allows bypass of intended access restrictions

Moodle allows attackers to bypass intended access restrictions

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.

Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.