Vulnerability Details CVE-2026-102578
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 14.5%
CVSS Severity
CVSS v3 Score 5.5
References
Products affected by CVE-2026-102578
-
cpe:2.3:a:moodle:moodle:5.0.0
-
cpe:2.3:a:moodle:moodle:5.0.1
-
cpe:2.3:a:moodle:moodle:5.0.2
-
cpe:2.3:a:moodle:moodle:5.0.3
-
cpe:2.3:a:moodle:moodle:5.0.4
-
cpe:2.3:a:moodle:moodle:5.0.5
-
cpe:2.3:a:moodle:moodle:5.0.6
-
cpe:2.3:a:moodle:moodle:5.0.7
-
cpe:2.3:a:moodle:moodle:5.1.0
-
cpe:2.3:a:moodle:moodle:5.1.1
-
cpe:2.3:a:moodle:moodle:5.1.2
-
cpe:2.3:a:moodle:moodle:5.1.3
-
cpe:2.3:a:moodle:moodle:5.1.4
-
cpe:2.3:a:moodle:moodle:5.2.0