Moodle vulnerable to site administration SQL injection via XMLDB editor

HIGH 7.2CVE-2024-43436 · BIT-moodle-2024-43436 · GHSA-mx26-62xm-2p83 · Published 07/11/2024 · updated 17/06/2026

In short

CVE-2024-43436 is a HIGH (CVSS 7.2) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 0.80%, higher than 56.5% of all vulnerabilities.
Fix: update to 4.2.9, 4.3.6, 4.4.2, 4.1.12 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 4.2.0-beta, < 4.2.9≥ 4.3.0-beta, < 4.3.6≥ 4.4.0-beta, < 4.4.2< 4.1.12`	`4.2.94.3.64.4.24.1.12`
moodle moodle	`≥ 4.1.0, < 4.1.12≥ 4.2.0, < 4.2.9≥ 4.3.0, < 4.3.6≥ 4.4.0, < 4.4.2`	`4.1.124.2.94.3.64.4.2`

A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.

NVD description

A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 4.2.0-beta, < 4.2.9≥ 4.3.0-beta, < 4.3.6≥ 4.4.0-beta, < 4.4.2< 4.1.12

4.2.94.3.64.4.24.1.12

≥ 4.1.0, < 4.1.12≥ 4.2.0, < 4.2.9≥ 4.3.0, < 4.3.6≥ 4.4.0, < 4.4.2

4.1.124.2.94.3.64.4.2

More vulnerabilities in moodle/moodle

See all →