| CVE-2023-28334 | TRUNG BÌNH4.3 | Authenticated users were able to enumerate other users' names via the learning plans page. | 23/03/2023 |
| CVE-2023-28333 | NGHIÊM TRỌNG9.8 | The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS). | 23/03/2023 |
| CVE-2023-28332 | TRUNG BÌNH6.1 | If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. | 23/03/2023 |
| CVE-2023-28331 | TRUNG BÌNH6.1 | Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. | 23/03/2023 |
| CVE-2023-28330 | TRUNG BÌNH6.5 | Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default. | 23/03/2023 |
| CVE-2023-28329 | CAO8.8 | Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers). | 23/03/2023 |
| CVE-2023-1402 | TRUNG BÌNH4.3 | The course participation report required additional checks to prevent roles being displayed which the user did not have access to view. | 23/03/2023 |
| CVE-2021-36403 | TRUNG BÌNH5.3 | In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. | 06/03/2023 |
| CVE-2021-36402 | TRUNG BÌNH5.3 | In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. | 06/03/2023 |
| CVE-2021-36401 | TRUNG BÌNH4.8 | In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. | 06/03/2023 |
| CVE-2021-36400 | TRUNG BÌNH5.3 | In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. | 06/03/2023 |
| CVE-2021-36399 | TRUNG BÌNH5.4 | In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. | 06/03/2023 |
| CVE-2021-36398 | TRUNG BÌNH5.4 | In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. | 06/03/2023 |
| CVE-2021-36397 | TRUNG BÌNH5.3 | In Moodle, insufficient capability checks meant message deletions were not limited to the current user. | 06/03/2023 |
| CVE-2021-36396 | CAO7.5 | In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. | 06/03/2023 |
| CVE-2021-36395 | CAO7.5 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. | 06/03/2023 |
| CVE-2021-36394 | NGHIÊM TRỌNG9.8 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. | 06/03/2023 |
| CVE-2021-36393 | NGHIÊM TRỌNG9.8 | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. | 06/03/2023 |
| CVE-2021-36392 | NGHIÊM TRỌNG9.8 | In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. | 06/03/2023 |
| CVE-2023-23923 | CAO8.2 | The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality. | 17/02/2023 |