Moodle SQL Injection vulnerability

CRITICAL 9.8CVE-2021-36393 · BIT-moodle-2021-36393 · GHSA-f46j-r7q3-6cm2 · Published 06/03/2023 · updated 17/06/2026

In short

CVE-2021-36393 is a CRITICAL (CVSS 9.8) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 52.3%, higher than 99.0% of all vulnerabilities.
Fix: update to 3.10.5, 3.11.1, 3.9.8 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 3.10.0-beta, < 3.10.5≥ 3.11.0-beta, < 3.11.1< 3.9.8`	`3.10.53.11.13.9.8`
moodle moodle	`≥ 3.10.0, < 3.10.5≥ 3.11.0, < 3.11.1< 3.9.8`	`3.10.53.11.13.9.8`

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

NVD description

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 3.10.0-beta, < 3.10.5≥ 3.11.0-beta, < 3.11.1< 3.9.8

3.10.53.11.13.9.8

≥ 3.10.0, < 3.10.5≥ 3.11.0, < 3.11.1< 3.9.8

3.10.53.11.13.9.8

More vulnerabilities in moodle/moodle

See all →