Moodle may display roles to users who don't have access to them

Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.

Cross-site scripting (XSS) vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter (blog entry title).

Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script

Moodle Remote Code Execution vulnerability

Cross-site scripting (XSS) vulnerability in course/lib.php in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via crafted log table information that is not properly handled when it is displayed in a log report.

Moodle does not consider the moodle/tag:flag capability

Moodle multiple cross-site request forgery (CSRF) vulnerabilities

Moodle context freezing

Moodle Blind SQL injection possible via MNet authentication

Moodle Oauth 2 Insufficiently Protects Against Compromise

Unknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting.

Cross-site scripting (XSS) vulnerability in an unspecified component of Moodle 1.5 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. NOTE: It is unclear whether this candidate overlaps CVE-2006-4784 or CVE-2006-4941.

Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.

Moodle Exposure of Sensitive Information to an Unauthorized Actor

Moodle course access permissions are not properly checked in course_output_fragment_course_overview

mod/glossary/showentry.php in the Glossary module for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not properly perform access control, which allows attackers to read unauthorized Glossary entries via unknown vectors.

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export

Moodle has a SQL injection risk in course search module list filter

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.