Technology · Packagist
moodle/moodle (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 434 vulnerabilities in moodle/moodle (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-26045, was published on 21 February 2026.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 0
- Exploited in the wild
- 0
About moodle/moodle (Packagist)
Open-source learning management system for creating and delivering online courses and educational content.
Latest moodle/moodle (Packagist) vulnerabilities
- CVE-2026-26045: Moodle has a Remote Code Execution risk via file restorelowCVSS 3.1EPSS 0.8%
- CVE-2026-26047: Moodle TeX formula editor is vulnerable to DoS through lack of execution time limitslowCVSS 3.1EPSS 0.6%
- CVE-2025-67852: Moodle Open Redirect vulnerabilitylowCVSS 3.1EPSS 0.2%
- CVE-2025-67855: Moodle vulnerable to Cross-site ScriptinglowCVSS 3.1EPSS 0.4%
- CVE-2025-67857: Moodle Inserts Sensitive Information Into Sent DatalowCVSS 3.1EPSS 0.3%
- CVE-2025-67856: Moodle has an authorization logic flawlowCVSS 3.1EPSS 0.3%
- CVE-2025-67853: Moodle Affected by Improper Restriction of Excessive Authentication AttemptslowCVSS 3.1EPSS 0.4%
- CVE-2025-67849: Moodle Cross-site Scripting (XSS) vulnerabilitylowCVSS 3.1EPSS 0.3%
- CVE-2025-67850: Moodle vulnerable to Cross-site ScriptinglowCVSS 3.1EPSS 0.3%
- CVE-2025-67851: Moodle formula injection vulnerabilitylowCVSS 3.1EPSS 0.3%
- CVE-2025-67848: Moodle authentication bypass vulnerabilitylowCVSS 3.1EPSS 0.4%
- CVE-2025-67847: Moodle affected by a code injection vulnerabilitylowCVSS 3.1EPSS 0.6%
- CVE-2025-62398: Moodle does not properly enforce MFAlowCVSS 3.1EPSS 0.3%
- CVE-2025-62396: Moodle's error handling leads to sensitive information disclosurelowCVSS 3.1EPSS 0.3%
- CVE-2025-62400: Moodle exposed the names of hidden groups to userslowCVSS 3.1EPSS 0.3%
- CVE-2025-62399: Moodle vulnerable to brute-force password guesseslowCVSS 3.1EPSS 0.4%
- CVE-2025-62401: Moodle has a time restriction bypasslowCVSS 3.1EPSS 0.2%
- CVE-2025-62393: Moodle course access permissions are not properly checked in course_output_fragment_course_overviewlowCVSS 3.1EPSS 0.3%
- CVE-2025-62394: Moodle sends quiz-related messages to inactive/suspended userslowCVSS 3.1EPSS 0.2%
- CVE-2025-53021: Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameterlowCVSS 3.1EPSS 0.3%
- CVE-2025-3647: Moodle allows IDOR when accessing the cohorts reportlowCVSS 3.1EPSS 0.3%
- CVE-2025-3643: Moodle has reflected Cross-site Scripting risk in policy toollowCVSS 3.1EPSS 0.3%
- CVE-2025-3644: Moodle's AJAX section delete does not respect course_can_delete_section()lowCVSS 3.1EPSS 0.3%
- CVE-2025-3637: Moodle's mod_data edit/delete pages pass CSRF token in GET parameterlowCVSS 3.1EPSS 0.4%
- CVE-2025-3641: Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repositorylowCVSS 3.1EPSS 1.0%
Most severe moodle/moodle (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2016-7038: Moodle web service token invalidation failure on password changehighCVSS 7.3EPSS 1.0%
- CVE-2017-2578: Moodle XSS in assignment submission pagemediumCVSS 6.1EPSS 0.9%
- CVE-2016-5013: Moodle email header injection vulnerabilitymediumCVSS 5.4EPSS 1.1%
- CVE-2016-5014: Moodle information disclosure in Event Monitor notificationsmediumCVSS 5.4EPSS 1.0%
- CVE-2016-8642: Moodle improper access control in question enginemediumCVSS 5.3EPSS 1.2%
- CVE-2016-5012: Moodle improper authorization in glossary searchmediumCVSS 5.3EPSS 1.1%
- CVE-2017-2576: Moodle incorrect attribute sanitization in forumsmediumCVSS 5.3EPSS 1.0%
- CVE-2011-4284: Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context pagemediumCVSS 4EPSS 2.1%
- CVE-2011-4283: Moodle allows remote attackers to obtain sensitive informationmediumCVSS 4EPSS 2.1%
- CVE-2011-4287: Moodle does not force password changes for autosubscribed usersmediumCVSS 4EPSS 2.1%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many moodle/moodle (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/moodle-moodle)<a href="https://junglewise.ai/threats/technologies/moodle-moodle"><img src="https://junglewise.ai/threats/technologies/moodle-moodle/badge.svg" alt="moodle/moodle (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/moodle-moodle.json, and this page as text at https://junglewise.ai/threats/technologies/moodle-moodle.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "moodle/moodle (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/moodle-moodle, 9 November 2026.