DeutschShown in its original language — a full translation is planned for a future version.
Moodle: Mehrere Schwachstellen
view advisory published 2025-02-17
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben oder andere nicht näher spezifizierte Auswirkungen zu verursachen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26533US | critical9.8 | — | ||
An SQL injection risk was identified in the module list filter within course search. | ||||
| CVE-2025-26532US | medium4.3OT elevated | — | ||
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. | ||||
| CVE-2025-26531US | medium5.3OT elevated | — | ||
Insufficient capability checks made it possible to disable badges a user does not have permission to access. | ||||
| CVE-2025-26530US | medium6.1 | — | ||
The question bank filter required additional sanitizing to prevent a reflected XSS risk. | ||||
| CVE-2025-26529US | medium6.1 | Exploit | ||
Description information displayed in the site administration live log
required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2025-26528US | medium6.1 | — | ||
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2025-26527US | — | — | ||
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. | ||||
| CVE-2025-26526US | —OT elevated | — | ||
Separate Groups mode restrictions were not factored into permission
checks before allowing viewing or deletion of responses in Feedback
activities. | ||||
| CVE-2025-26525US | — | — | ||
Insufficient sanitizing in the TeX notation filter resulted in an
arbitrary file read risk on sites where pdfTeX is available (such as
those with TeX Live installed). | ||||
02
references
External citations — patches, advisories, analysis.
- Moodle Security announcements vom 2025-02-17external
- Moodle Security announcements vom 2025-02-17external
- Moodle Security announcements vom 2025-02-17external
- Moodle Security announcements vom 2025-02-17external
- Moodle Security announcements vom 2025-02-17external
- Moodle Security announcements vom 2025-02-17external
- Moodle Security announcements vom 2025-02-17external
- Moodle Security announcements vom 2025-02-17external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan