# moodle/moodle (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/moodle-moodle Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/moodle-moodle.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 434 vulnerabilities in moodle/moodle (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-26045, was published on 21 February 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 434 (0 critical, 0 exploited in the wild) ## About moodle/moodle (Packagist) Open-source learning management system for creating and delivering online courses and educational content. ## Latest moodle/moodle (Packagist) vulnerabilities - [CVE-2026-26045: Moodle has a Remote Code Execution risk via file restore](https://junglewise.ai/threats/cve-2026-26045-moodle-has-a-remote-code-execution-risk-via-file-restore) (low, CVSS 3.1, published 21 Feb 2026) - [CVE-2026-26047: Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits](https://junglewise.ai/threats/cve-2026-26047-moodle-tex-formula-editor-is-vulnerable-to-dos-through-lack-of) (low, CVSS 3.1, published 21 Feb 2026) - [CVE-2025-67852: Moodle Open Redirect vulnerability](https://junglewise.ai/threats/cve-2025-67852-moodle-open-redirect-vulnerability) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67855: Moodle vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2025-67855-moodle-vulnerable-to-cross-site-scripting) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67857: Moodle Inserts Sensitive Information Into Sent Data](https://junglewise.ai/threats/cve-2025-67857-moodle-inserts-sensitive-information-into-sent-data) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67856: Moodle has an authorization logic flaw](https://junglewise.ai/threats/cve-2025-67856-moodle-has-an-authorization-logic-flaw) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67853: Moodle Affected by Improper Restriction of Excessive Authentication Attempts](https://junglewise.ai/threats/cve-2025-67853-moodle-affected-by-improper-restriction-of-excessive) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67849: Moodle Cross-site Scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2025-67849-moodle-cross-site-scripting-xss-vulnerability) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67850: Moodle vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2025-67850-moodle-vulnerable-to-cross-site-scripting) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67851: Moodle formula injection vulnerability](https://junglewise.ai/threats/cve-2025-67851-moodle-formula-injection-vulnerability) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67848: Moodle authentication bypass vulnerability](https://junglewise.ai/threats/cve-2025-67848-moodle-authentication-bypass-vulnerability) (low, CVSS 3.1, published 3 Feb 2026) - [CVE-2025-67847: Moodle affected by a code injection vulnerability](https://junglewise.ai/threats/cve-2025-67847-moodle-affected-by-a-code-injection-vulnerability) (low, CVSS 3.1, published 23 Jan 2026) - [CVE-2025-62398: Moodle does not properly enforce MFA](https://junglewise.ai/threats/cve-2025-62398-moodle-does-not-properly-enforce-mfa) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-62396: Moodle's error handling leads to sensitive information disclosure](https://junglewise.ai/threats/cve-2025-62396-moodle-s-error-handling-leads-to-sensitive-information-disclosure) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-62400: Moodle exposed the names of hidden groups to users](https://junglewise.ai/threats/cve-2025-62400-moodle-exposed-the-names-of-hidden-groups-to-users) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-62399: Moodle vulnerable to brute-force password guesses](https://junglewise.ai/threats/cve-2025-62399-moodle-vulnerable-to-brute-force-password-guesses) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-62401: Moodle has a time restriction bypass](https://junglewise.ai/threats/cve-2025-62401-moodle-has-a-time-restriction-bypass) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-62393: Moodle course access permissions are not properly checked in course_output_fragment_course_overview](https://junglewise.ai/threats/cve-2025-62393-moodle-course-access-permissions-are-not-properly-checked-in) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-62394: Moodle sends quiz-related messages to inactive/suspended users](https://junglewise.ai/threats/cve-2025-62394-moodle-sends-quiz-related-messages-to-inactive-suspended-users) (low, CVSS 3.1, published 23 Oct 2025) - [CVE-2025-53021: Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter](https://junglewise.ai/threats/cve-2025-53021-moodle-session-fixation-allows-unauthenticated-users-to-hijack) (low, CVSS 3.1, published 24 Jun 2025) - [CVE-2025-3647: Moodle allows IDOR when accessing the cohorts report](https://junglewise.ai/threats/cve-2025-3647-moodle-allows-idor-when-accessing-the-cohorts-report) (low, CVSS 3.1, published 25 Apr 2025) - [CVE-2025-3643: Moodle has reflected Cross-site Scripting risk in policy tool](https://junglewise.ai/threats/cve-2025-3643-moodle-has-reflected-cross-site-scripting-risk-in-policy-tool) (low, CVSS 3.1, published 25 Apr 2025) - [CVE-2025-3644: Moodle's AJAX section delete does not respect course_can_delete_section()](https://junglewise.ai/threats/cve-2025-3644-moodle-s-ajax-section-delete-does-not-respect-course-can-delete) (low, CVSS 3.1, published 25 Apr 2025) - [CVE-2025-3637: Moodle's mod_data edit/delete pages pass CSRF token in GET parameter](https://junglewise.ai/threats/cve-2025-3637-moodle-s-mod-data-edit-delete-pages-pass-csrf-token-in-get) (low, CVSS 3.1, published 25 Apr 2025) - [CVE-2025-3641: Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository](https://junglewise.ai/threats/cve-2025-3641-moodle-has-an-authenticated-remote-code-execution-risk-in-the) (low, CVSS 3.1, published 25 Apr 2025) ## Most severe moodle/moodle (Packagist) vulnerabilities - [CVE-2016-7038: Moodle web service token invalidation failure on password change](https://junglewise.ai/threats/cve-2016-7038-moodle-web-service-token-invalidation-failure-on-password-change) (high, CVSS 7.3, published 20 Jan 2017) - [CVE-2017-2578: Moodle XSS in assignment submission page](https://junglewise.ai/threats/cve-2017-2578-moodle-xss-in-assignment-submission-page) (medium, CVSS 6.1, published 20 Jan 2017) - [CVE-2016-5013: Moodle email header injection vulnerability](https://junglewise.ai/threats/cve-2016-5013-moodle-email-header-injection-vulnerability) (medium, CVSS 5.4, published 20 Jan 2017) - [CVE-2016-5014: Moodle information disclosure in Event Monitor notifications](https://junglewise.ai/threats/cve-2016-5014-moodle-information-disclosure-in-event-monitor-notifications) (medium, CVSS 5.4, published 20 Jan 2017) - [CVE-2016-8642: Moodle improper access control in question engine](https://junglewise.ai/threats/cve-2016-8642-moodle-improper-access-control-in-question-engine) (medium, CVSS 5.3, published 20 Jan 2017) - [CVE-2016-5012: Moodle improper authorization in glossary search](https://junglewise.ai/threats/cve-2016-5012-moodle-improper-authorization-in-glossary-search) (medium, CVSS 5.3, published 20 Jan 2017) - [CVE-2017-2576: Moodle incorrect attribute sanitization in forums](https://junglewise.ai/threats/cve-2017-2576-moodle-incorrect-attribute-sanitization-in-forums) (medium, CVSS 5.3, published 20 Jan 2017) - [CVE-2011-4284: Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page](https://junglewise.ai/threats/cve-2011-4284-moodle-allows-remote-attackers-to-obtain-sensitive-information) (medium, CVSS 4, published 13 May 2022) - [CVE-2011-4283: Moodle allows remote attackers to obtain sensitive information](https://junglewise.ai/threats/cve-2011-4283-moodle-allows-remote-attackers-to-obtain-sensitive-information) (medium, CVSS 4, published 13 May 2022) - [CVE-2011-4287: Moodle does not force password changes for autosubscribed users](https://junglewise.ai/threats/cve-2011-4287-moodle-does-not-force-password-changes-for-autosubscribed-users) (medium, CVSS 4, published 13 May 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities - [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq): 119 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "moodle/moodle (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/moodle-moodle, 9 November 2026.