The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.

Moodle has CSRF risk in Feedback non-respondents report

Moodle vulnerable to symlink attack

Cross-site scripting (XSS) vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title.

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.

External Control of Assumed-Immutable Web Parameter in moodle

Unspecified vulnerability in the Calendar export feature in Moodle 1.8 before 1.8.8 and 1.9 before 1.9.4 allows attackers to obtain sensitive information and conduct "brute force attacks on user accounts" via unknown vectors.

Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task.

moodle: IDOR in edit/delete RSS feed

Moodle does not consider "don't send" attributes during hub registration

Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.

Moodle Unauthenticated Access

Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to

Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle

Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory

Moodle Authenticated Spelling Binary Remote Code Execution

Moodle vulnerable to Cross-site Request Forgery

Moodle Information Disclosure vulnerability

Moodle Stored XSS and blind SSRF possible via SCORM track details

Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs.