The URL parameters accepted by forum search were not limited to the al ...

Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

Insufficient file size checks resulted in a denial of service risk in ...

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.

Inadequate access control in Moodle LMS. This vulnerability could allo ...

The course upload preview contained an XSS risk for users uploading unsafe data.

The course upload preview contained an XSS risk for users uploading unsafe data.

The course upload preview contained an XSS risk for users uploading un ...

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

ID numbers displayed in the quiz grading report required additional sa ...

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

Wiki comments required additional sanitizing and access restrictions t ...

The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.

The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.

The CSV grade import method contained an XSS risk for users importing ...

** DISPUTED ** Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."