Product by Moodle Project
Moodle
13 known vulnerabilities in Moodle (Moodle Project), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-119553 | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal | 6.5 | |
| Critical | CVE-2025-26533 | SQL injection risk in course search module list filter | 8.1 | |
| High | CVE-2025-26529 | Stored XSS risk in admin live log | 8.3 | |
| High | CVE-2025-26525 | Arbitrary file read risk through pdfTeX | 8.6 | |
| Medium | CVE-2026-119554 | Moodle: SQL Injection | 5.9 | |
| Medium | CVE-2026-119556 | Moodle: Missing Authorization | 4.3 | |
| High | CVE-2025-26530 | Reflected XSS via question bank filter | 8.3 | |
| Medium | CVE-2026-119555 | Moodle: Authorization Bypass Through User-Controlled Key | 4.3 | |
| Medium | CVE-2025-26526 | Feedback response viewing and deletions did not respect Separate Groups mode | 6.5 | |
| Medium | CVE-2025-26527 | Non-searchable tags can still be discovered on the tag search page and in the tags block | 5.3 | |
| Medium | CVE-2025-26528 | Stored XSS in ddimageortext question type | 3.4 | |
| Medium | CVE-2025-26531 | IDOR in badges allows disabling of arbitrary badges | 3.1 | |
| Medium | CVE-2025-26532 | Teachers can evade trusttext config when restoring glossary entries | 3.1 |