Moodle SQL Injection vulnerability

The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.

Moodle's user/power level management inconsistent with suspended users

Moodle Persistent Cross-site Scripting (XSS)

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.

Moodle doesn't properly check role

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

Cross-site scripting (XSS) vulnerability in help.php in Moodle 1.3.2 and 1.4 dev allows remote attackers to inject arbitrary web script or HTML via the file parameter.

Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input

Moodle's feedback response viewing and deletions did not respect Separate Groups mode

Moodle allows remote authenticated users to reassign notes

Moodle may allow teachers to access the names of users they could not otherwise access

Cross-site scripting (XSS) vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424.

Moodle has an IDOR in messaging web service which allows access to some user details

Moodle Secure layout contained an insecure link in Boost theme

Moodle does not use the forceloginforprofiles setting for course-profiles access control

backup/backup_scheduled.php in Moodle before 1.6.2 generates trace data with the full backup pathname even when debugging is disabled, which might allow attackers to obtain the pathname.

Moodle includes the WebDAV password in the configuration form

Moodle Arbitrary file read when importing lesson questions

Cross-site Scripting (XSS) in moodle