Vulnerabilities > Moodle
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-22 | CVE-2021-3943 | Improper Input Validation vulnerability in Moodle A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. | 9.8 |
| 2021-11-22 | CVE-2021-43558 | Cross-site Scripting vulnerability in multiple products A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. | 6.1 |
| 2021-11-22 | CVE-2021-43559 | Cross-Site Request Forgery (CSRF) vulnerability in multiple products A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. | 8.8 |
| 2021-11-22 | CVE-2021-43560 | Exposure of Resource to Wrong Sphere vulnerability in multiple products A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. | 5.3 |
| 2021-06-23 | CVE-2021-21809 | OS Command Injection vulnerability in Moodle 3.10.0 A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. | 9.1 |
| 2021-06-16 | CVE-2021-32244 | Cross-site Scripting vulnerability in Moodle 3.10.3 Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field. | 5.4 |
| 2021-05-17 | CVE-2019-14827 | Code Injection vulnerability in Moodle A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. | 6.1 |
| 2021-03-19 | CVE-2019-14831 | Open Redirect vulnerability in Moodle A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open redirect if forced subscription mode was enabled. | 6.1 |
| 2021-03-19 | CVE-2019-14830 | Open Redirect vulnerability in Moodle A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an open redirect in some circumstances, which could result in a user's mobile access token being exposed. | 6.1 |
| 2021-03-19 | CVE-2019-14829 | Improper Following of Specification by Caller vulnerability in Moodle A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode. | 4.3 |