CVE-2025-62395

Moodle: external cohort search service leaks system cohort data

A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-62396

Moodle: router (r.php) could expose application directories

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-62397

Moodle: router produces json instead of 404 error for invalid course id

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-62398

Moodle: possible to bypass mfa

A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-62399

Moodle: password brute force risk when mobile/web services enabled

Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-62400

Moodle: hidden group names visible to event creators

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-62401

Moodle: possible to bypass timer in timed assignments

An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26530

Reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26525

Arbitrary file read risk through pdfTeX

Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26526

Feedback response viewing and deletions did not respect Separate Groups mode

Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26527

Non-searchable tags can still be discovered on the tag search page and in the tags block

Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26528

Stored XSS in ddimageortext question type

The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26529

Stored XSS risk in admin live log

Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2024-38277

moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Moodle

Products

Fedora Moodle

CVE-2024-38274

moodle: stored XSS via calendar's event title when deleting the event

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Moodle

Products

Fedora Moodle

CVE-2024-38273

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Moodle

Products

Fedora Moodle

CVE-2025-26531

IDOR in badges allows disabling of arbitrary badges

Insufficient capability checks made it possible to disable badges a user does not have permission to access.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26532

Teachers can evade trusttext config when restoring glossary entries

Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2025-26533

SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2024-43438

Moodle: idor in feedback non-respondents report allows messaging arbitrary site users

A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle