Vulnerabilities > Moodle > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-11-18 | CVE-2024-48896 | Information Exposure Through an Error Message vulnerability in Moodle A vulnerability was found in Moodle. | 4.3 |
| 2024-11-18 | CVE-2024-48897 | Incorrect Authorization vulnerability in Moodle A vulnerability was found in Moodle. | 4.3 |
| 2024-11-18 | CVE-2024-48898 | Missing Authorization vulnerability in Moodle A vulnerability was found in Moodle. | 4.3 |
| 2024-11-18 | CVE-2024-48901 | Incorrect Authorization vulnerability in Moodle A vulnerability was found in Moodle. | 4.3 |
| 2024-06-24 | CVE-2024-34312 | Cross-site Scripting vulnerability in Moodle Virtual Programming LAB Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js. | 6.1 |
| 2023-11-09 | CVE-2023-5541 | Cross-site Scripting vulnerability in Moodle The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content. | 6.1 |
| 2023-11-09 | CVE-2023-5542 | Exposure of Resource to Wrong Sphere vulnerability in multiple products Students in "Only see own membership" groups could see other students in the group, which should be hidden. | 4.3 |
| 2023-11-09 | CVE-2023-5544 | Authorization Bypass Through User-Controlled Key vulnerability in multiple products Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. | 5.4 |
| 2023-11-09 | CVE-2023-5545 | Exposure of Resource to Wrong Sphere vulnerability in multiple products H5P metadata automatically populated the author with the user's username, which could be sensitive information. | 5.3 |
| 2023-11-09 | CVE-2023-5546 | Cross-site Scripting vulnerability in multiple products ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. | 5.4 |