Moodle allows attackers to obtain sensitive course-structure information

** DISPUTED ** Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields."

Moodle Denial of Service

Moodle XSS In Tag Autocomplete functionality

Moodle does not properly manage privileges for WebDAV repositories

lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.

Moodle does not properly restrict comment capabilities

Moodle LTI module reflected XSS risk

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.

Moodle allows attackers to bypass file-management restrictions

Multiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors.

Moodle Open Redirect Vulnerability

Cross site-scripting (XSS) moodle

Moodle stored Cross-site Scripting

Moodle Users could elevate their role when accessing the LTI tool on a provider site

Moodle Exposure of Sensitive Information to an Unauthorized Actor

Moodle allows attackers to modify the visibility of a badge

Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block

Moodle Improper Access Control vulnerability

Moodle cross-site request forgery (CSRF) vulnerability