According to its self-reported version, the Moodle install hosted on the remote host is prior to 4.1.10, or 4.2.x prior to 4.2.7 or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple vulnerabilities.

- Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

- The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.

- ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

- Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.

- Additional sanitizing was required when opening the equation editor, to prevent a stored XSS risk when editing another user's equation.

- Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114727	Moodle 4.2.x < 4.2.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
114726	Moodle < 4.1.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
114728	Moodle 4.3.x < 4.3.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high

Detections

Analytics

Plugins Search

high

high

high