lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role.

login/forgot_password.php in Moodle before 1.6.2 allows remote attackers to obtain sensitive information (e-mail addresses and Moodle account names) via a find action.

Moodle does not set the RISK_XSS bit for graders

Moodle Cross-site Scripting in assignment submission page

Improper Authentication in moodle

backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action.

Moodle's time-validation implementation allows bypassing intended restrictions

Moodle XSS from profile fields from external db

Moodle vulnerable to Cross-site Scripting

help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message.

SQL injection in Moodle

Moodle reflected cross-site scripting vulnerability in policy tool

mod/feedback/lib.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/feedback:view capability before displaying recent feedback, which allows remote authenticated users to obtain sensitive information via a request for all course feedback that has occurred since a specified time.

Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.

Moodle reveals student identities through assignment submissions search on anonymous submissions

SQL injection in moodle

Moodle multiple cross-site scripting (XSS) vulnerabilities

Moodle CSRF risk in analytics management of models

SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls _adodb_column_sql in the adodb layer (lib/adodb/adodb-lib.inc.php), which does not convert the data type to an int.