Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
663 results · page 3 of 14
Nov 7, 2024A flaw was found in Moodle.CVE-2024-43425 · Other software · moodle · reported by patrick@puiterwijk.orgHigh 8.1
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.commoodle.org
Jun 24, 2024Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js.CVE-2024-34312 · Other software · vpl · reported by MITREMedium 6.1
Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js.
- Product
- jail_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.CVE-2024-37674 · Other software · moodle · reported by MITREMedium 5.5
Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.CVE-2024-38277 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jun 18, 2024Incorrect CSRF token checks resulted in multiple CSRF risks.CVE-2024-38276 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 8.8
Incorrect CSRF token checks resulted in multiple CSRF risks.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jun 18, 2024The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally senCVE-2024-38275 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.CVE-2024-38274 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jun 18, 2024Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.CVE-2024-38273 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
May 31, 2024Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page.CVE-2024-34009 · Other software · moodle · reported by patrick@puiterwijk.orgHigh 7.5
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.CVE-2024-34008 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 8.8
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.CVE-2024-34007 · Other software · moodle · reported by patrick@puiterwijk.orgHigh 8.8
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activityCVE-2024-34005 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and CVE-2024-34004 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules CVE-2024-34003 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 5.9
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules CVE-2024-34002 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.CVE-2024-34001 · Other software · moodle · reported by patrick@puiterwijk.orgHigh 8.4
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.CVE-2024-34000 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024The referrer URL used by MFA required additional sanitizing, rather than being used directly.CVE-2024-33999 · Other software · Moodle · reported by patrick@puiterwijk.orgCritical 9.8
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.CVE-2024-33998 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.CVE-2024-33997 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have peCVE-2024-33996 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.2
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance deCVE-2024-28593 · Other software · Moodle · reported by MITREMedium 5.4
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be removed from standard Moodle."
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.moodle.orggist.githubusercontent.com
Mar 21, 2024A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.CVE-2024-29374 · Other software · moodle · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 19, 2024Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.gCVE-2024-25983 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.5
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 19, 2024The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.CVE-2024-25982 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 19, 2024Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups.CVE-2024-25981 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 19, 2024Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups.CVE-2024-25980 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 4.3
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
- Product
- h5p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 19, 2024The URL parameters accepted by forum search were not limited to the allowed parameters.CVE-2024-25979 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 5.3
The URL parameters accepted by forum search were not limited to the allowed parameters.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 19, 2024Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.CVE-2024-25978 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 12, 2024Inadequate access control in Moodle LMS.CVE-2024-1439 · Other software · Moodle · reported by cve-coordination@incibe.esMedium 6.5
Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity.CVE-2023-5543 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.CVE-2023-5551 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server CVE-2023-5550 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capabCVE-2023-5549 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.CVE-2023-5548 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023The course upload preview contained an XSS risk for users uploading unsafe data.CVE-2023-5547 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
The course upload preview contained an XSS risk for users uploading unsafe data.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.CVE-2023-5546 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 4.3
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023H5P metadata automatically populated the author with the user's username, which could be sensitive information.CVE-2023-5545 · Other software · moodle · reported by patrick@puiterwijk.orgLow 3.3
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
- Product
- h5p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.CVE-2023-5544 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023Students in "Only see own membership" groups could see other students in the group, which should be hidden.CVE-2023-5542 · Other software · moodle · reported by patrick@puiterwijk.orgLow 3.3
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.CVE-2023-5541 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023A remote code execution risk was identified in the IMSCP activity.CVE-2023-5540 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.7
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023A remote code execution risk was identified in the Lesson activity.CVE-2023-5539 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 4.7
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Oct 28, 2023Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher.CVE-2023-46858 · Other software · Moodle · reported by MITREMedium 5.4
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.moodle.orggist.github.com
Jun 22, 2023An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk.CVE-2023-35133 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Jun 22, 2023A limited SQL injection risk was identified on the Mnet SSO access control page.CVE-2023-35132 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.3
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Jun 22, 2023Content on the groups page required additional sanitizing to prevent an XSS risk.CVE-2023-35131 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
May 16, 2023Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header CVE-2021-27131 · Other software · Moodle · reported by MITREMedium 5.4
Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because the "Additional HTML Section" for "Header and Footer" can only be supplied by an administrator, who is intentionally allowed to enter unsanitized input (e.g., site-specific JavaScript).
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.moodle.orggithub.com
May 2, 2023The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages.CVE-2023-30944 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.6
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
May 2, 2023The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders.CVE-2023-30943 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.