Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
CVSS Score
8.8
EPSS Score
0.001
Published
2017-04-20
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.
CVSS Score
5.4
EPSS Score
0.002
Published
2017-03-29
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
CVSS Score
9.8
EPSS Score
0.019
Published
2017-03-26
In Moodle 3.2.x, global search displays user names for unauthenticated users.
CVSS Score
5.3
EPSS Score
0.008
Published
2017-03-26
In Moodle 3.x, XSS can occur via evidence of prior learning.
CVSS Score
6.1
EPSS Score
0.003
Published
2017-03-26
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.
CVSS Score
6.1
EPSS Score
0.003
Published
2017-03-26
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
CVSS Score
5.3
EPSS Score
0.002
Published
2017-01-20
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
CVSS Score
5.4
EPSS Score
0.004
Published
2017-01-20
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
CVSS Score
5.4
EPSS Score
0.002
Published
2017-01-20
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
CVSS Score
7.3
EPSS Score
0.002
Published
2017-01-20