A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content.

Authentication endpoints for the mobile client and authwebservice allowed unlimited or insufficiently throttled password attempts. This could enable attackers to systematically guess passwords for known usernames.

Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21

A missing capability check in the calendar event creation flow allows users with event creation rights to see names of hidden or separate groups. This may expose group names meant to remain private within a course.

Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.

A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.

A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.

Due to insufficient enrolment validation, quiz notifications could be sent to users with inactive or suspended enrolments. This information disclosure occurs automatically through the notification system and can reveal limited details about ongoing assessments.

Versions affected: 5.0 to 5.0.2 and 4.5 to 4.5.6 Versions fixed: 5.0.3 and 4.5.7

A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.

A flaw was found in Moodle's H5P content handling. Insufficient access checks on H5P content files, including extracted and repackaged content stored in the system context and files belonging to hidden or unavailable course modules, could allow users, including those who were not logged in, to view H5P content they did not have permission to access.

Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions.

Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter in /blocks/openaichat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries that are executed with that block's configuration. This can expose administrator-only Source of Truth entries, alter model behavior, and potentially misuse API resources.

Cross site scripting vulnerability in Moodle GeniAI plugin (localgeniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.

Configurable Reports block for Moodle (moodle-blockconfigurablereports) before 5.3.1 contains an sql injection vulnerability in reportsql::preparesql() via the filtervar request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTERVAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

End of life: 10/1/2029, End of support: 10/4/2027, Latest version: 5.3.0

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.

A flaw was found in Moodle. Insufficient escaping of the username on the password reset page allowed a minor cross-site scripting (XSS) risk if an unauthenticated user was tricked into opening a crafted password reset link. The reporter states this did not affect authenticated user sessions; that disclaimer is reflected in the impact assessment here.

A flaw was found in Moodle. Insufficient escaping in templates used to display forum posts resulted in a cross-site scripting (XSS) risk, allowing a stored script to execute in the browser of another user who views the affected forum post.

A flaw was found in Moodle. The manual enrolment management page did not correctly observe the disabled state of the manual enrolment plugin, allowing direct access to the page when the plugin was disabled and no longer linked from the UI. The relevant enrolment capability was still required to access the page, limiting the practical impact.

A flaw was found in Moodle. An incorrect capability check in the AI editor placement's "generate image" web service allowed a user to invoke that feature without holding the required capability. The advisory does not state the exact privilege level of an affected user; this draft assumes access is limited to users who already hold some content-editing role rather than a fully anonymous or lowest-privilege user.

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

A flaw was found in Moodle. A SQL injection risk was identified in a question bank web service, allowing unsanitized input to reach a database query. The advisory does not state the exact capability required to call the affected web service function; this draft assumes it requires an elevated (teacher-level) role rather than being reachable by a basic authenticated user.

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

A flaw was found in Moodle. User list filters did not respect user profile field visibility settings, allowing a manager to filter by a profile field they could not otherwise view on a user's profile, resulting in partial, inference-based information disclosure.

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).

A flaw was found in Moodle. The XML grade import functionality, which allows setting or overwriting of student grades, did not include the token required to prevent a cross-site request forgery (CSRF) risk, allowing an attacker to overwrite grades on behalf of a logged-in victim who visits a malicious page.