# Moodle vulnerabilities Source: https://junglewise.ai/threats/vendors/moodle Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/moodle.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in Moodle: 1 in the last 7 days and 15 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123655, was published on 6 November 2026. 6 vulnerabilities in the last four weeks, down 33% on the four before (9). 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 1 - Last 30 days: 6 - Last 90 days: 15 - All time: 29 (1 critical, 0 exploited in the wild) ## About Moodle Moodle is an open-source learning management system for creating online courses and educational content. ## Latest Moodle vulnerabilities - [CVE-2026-123655: Moodle insufficient access control in H5P content files](https://junglewise.ai/threats/cve-2026-123655-a-flaw-was-found-in-moodle-insufficient-access-control-checks-on) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2026-119556: Moodle missing capability check in core_grades_get_gradeitems](https://junglewise.ai/threats/cve-2026-119556-moodle-4-2-0-through-4-5-15-5-0-0-through-5-0-11-5-1-0-through-5) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-119555: Moodle core_grades_get_feedback information disclosure](https://junglewise.ai/threats/cve-2026-119555-moodle-4-2-0-through-4-5-15-5-0-0-through-5-0-11-5-1-0-through-5) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-119554: Moodle SQL injection in External database enrolment plugin](https://junglewise.ai/threats/cve-2026-119554-moodle-5-3-0-5-2-0-through-5-2-4-5-1-0-through-5-1-8-5-0-0) (medium, CVSS 5.9, published 30 Oct 2026) - [CVE-2026-119553: Moodle path traversal in Blackboard question import](https://junglewise.ai/threats/cve-2026-119553-moodle-5-3-0-5-2-0-through-5-2-4-5-1-0-through-5-1-8-5-0-0) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-113607: Moodle Configurable Reports block authorization bypass](https://junglewise.ai/threats/cve-2026-113607-configurable-reports-block-for-moodle-before-5-3-0-contains-an) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-102588: Moodle XML grade import CSRF vulnerability](https://junglewise.ai/threats/cve-2026-102588-a-flaw-was-found-in-moodle-the-xml-grade-import-feature-lacks) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-102586: Moodle cross-site scripting in password reset](https://junglewise.ai/threats/cve-2026-102586-a-flaw-was-found-in-moodle-insufficient-sanitization-of-username) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-102585: Moodle group enrollment authorization bypass](https://junglewise.ai/threats/cve-2026-102585-a-flaw-was-found-in-moodle-when-enrolling-a-user-into-a-course) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-102584: Moodle missing capability check in grade penalty recalculation](https://junglewise.ai/threats/cve-2026-102584-a-flaw-was-found-in-moodle-due-to-a-missing-capability-check-a) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-102581: Moodle stored cross-site scripting in forum templates](https://junglewise.ai/threats/cve-2026-102581-a-flaw-was-found-in-moodle-insufficient-output-escaping-in) (medium, CVSS 4.6, published 30 Sep 2026) - [CVE-2026-102579: Moodle grade web service privilege escalation](https://junglewise.ai/threats/cve-2026-102579-a-flaw-was-found-in-moodle-an-incorrect-capability-check-in-the) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-102578: Moodle SQL injection in question bank web service](https://junglewise.ai/threats/cve-2026-102578-a-flaw-was-found-in-moodle-an-authenticated-attacker-with-access) (medium, CVSS 5.5, published 30 Sep 2026) - [CVE-2026-102577: Moodle SSRF in URL downloader IPv4-mapped IPv6 bypass](https://junglewise.ai/threats/cve-2026-102577-a-flaw-was-found-in-moodle-incorrect-handling-of-ipv4-mapped) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2025-63564: Moodle Socialwall plugin SQL injection](https://junglewise.ai/threats/cve-2025-63564-sql-injection-vulnerability-in-moodle-socialwall-plugin-v-3-0) (critical, CVSS 9.8, published 23 Sep 2026) - [CVE-2022-50943: Moodle LMS cross-site scripting in course search](https://junglewise.ai/threats/cve-2022-50943-moodle-lms-cross-site-scripting-in-course-search) (medium, CVSS 6.1, published 10 May 2026) - [CVE-2025-60511: Moodle OpenAI Chat Block IDOR in completion.php](https://junglewise.ai/threats/cve-2025-60511-moodle-openai-chat-block-idor-in-completion-php) (medium, CVSS 4.3, published 21 Oct 2025) - [CVE-2013-4942: Yahoo YUI flashuploader.swf cross-site scripting](https://junglewise.ai/threats/cve-2013-4942-yahoo-yui-flashuploader-swf-cross-site-scripting) (medium, CVSS 4, published 13 May 2022) - [CVE-2013-4940: Yahoo YUI Cross-site Scripting in io.swf](https://junglewise.ai/threats/cve-2013-4940-yahoo-yui-cross-site-scripting-in-io-swf) (medium, CVSS 4, published 13 May 2022) - [CVE-2013-4941: YUI Uploader cross-site scripting in flash component](https://junglewise.ai/threats/cve-2013-4941-yui-uploader-cross-site-scripting-in-flash-component) (medium, CVSS 4, published 13 May 2022) - [CVE-2017-2578: Moodle XSS in assignment submission page](https://junglewise.ai/threats/cve-2017-2578-moodle-xss-in-assignment-submission-page) (medium, CVSS 6.1, published 20 Jan 2017) - [CVE-2017-2576: Moodle incorrect attribute sanitization in forums](https://junglewise.ai/threats/cve-2017-2576-moodle-incorrect-attribute-sanitization-in-forums) (medium, CVSS 5.3, published 20 Jan 2017) - [CVE-2016-8644: Moodle improper access control in course notes](https://junglewise.ai/threats/cve-2016-8644-moodle-improper-access-control-in-course-notes) (medium, CVSS 5.3, published 20 Jan 2017) - [CVE-2016-8643: Moodle improper access control in web services](https://junglewise.ai/threats/cve-2016-8643-moodle-improper-access-control-in-web-services) (medium, CVSS 4.3, published 20 Jan 2017) - [CVE-2016-8642: Moodle improper access control in question engine](https://junglewise.ai/threats/cve-2016-8642-moodle-improper-access-control-in-question-engine) (medium, CVSS 5.3, published 20 Jan 2017) ## Most severe Moodle vulnerabilities - [CVE-2025-63564: Moodle Socialwall plugin SQL injection](https://junglewise.ai/threats/cve-2025-63564-sql-injection-vulnerability-in-moodle-socialwall-plugin-v-3-0) (critical, CVSS 9.8, published 23 Sep 2026) - [CVE-2026-123655: Moodle insufficient access control in H5P content files](https://junglewise.ai/threats/cve-2026-123655-a-flaw-was-found-in-moodle-insufficient-access-control-checks-on) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2016-7038: Moodle web service token invalidation failure on password change](https://junglewise.ai/threats/cve-2016-7038-moodle-web-service-token-invalidation-failure-on-password-change) (high, CVSS 7.3, published 20 Jan 2017) - [CVE-2026-119553: Moodle path traversal in Blackboard question import](https://junglewise.ai/threats/cve-2026-119553-moodle-5-3-0-5-2-0-through-5-2-4-5-1-0-through-5-1-8-5-0-0) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-113607: Moodle Configurable Reports block authorization bypass](https://junglewise.ai/threats/cve-2026-113607-configurable-reports-block-for-moodle-before-5-3-0-contains-an) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-102588: Moodle XML grade import CSRF vulnerability](https://junglewise.ai/threats/cve-2026-102588-a-flaw-was-found-in-moodle-the-xml-grade-import-feature-lacks) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2017-2578: Moodle XSS in assignment submission page](https://junglewise.ai/threats/cve-2017-2578-moodle-xss-in-assignment-submission-page) (medium, CVSS 6.1, published 20 Jan 2017) - [CVE-2022-50943: Moodle LMS cross-site scripting in course search](https://junglewise.ai/threats/cve-2022-50943-moodle-lms-cross-site-scripting-in-course-search) (medium, CVSS 6.1, published 10 May 2026) - [CVE-2026-119554: Moodle SQL injection in External database enrolment plugin](https://junglewise.ai/threats/cve-2026-119554-moodle-5-3-0-5-2-0-through-5-2-4-5-1-0-through-5-1-8-5-0-0) (medium, CVSS 5.9, published 30 Oct 2026) - [CVE-2026-102578: Moodle SQL injection in question bank web service](https://junglewise.ai/threats/cve-2026-102578-a-flaw-was-found-in-moodle-an-authenticated-attacker-with-access) (medium, CVSS 5.5, published 30 Sep 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, down 33% on the four before (9). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 1 | 0 | | 28 Sep 2026 | 8 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Moodle technologies - [Moodle](https://junglewise.ai/threats/technologies/moodle): 26 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Moodle vulnerabilities", https://junglewise.ai/threats/vendors/moodle, 9 November 2026.