Path
Home
Location
madasolis GmbH, Germany
Reported vulnerabilities
45+
Response
usually within one working day

Software, AI and e-learning for universities and companies.

From web applications to Moodle plugins: we plan, build and maintain your software and review it with the knowledge gained from more than 45 reported vulnerabilities.

Start a project → See examples ↓

1How would you solve this for us?

5 cases, no client data

Five typical situations and how we approach them. Choose the one closest to yours.

SituationA plugin from the Moodle 3.x days, the developer can no longer be reached, the next upgrade is due.

Fig. 1.1: Life cycle of a plugin
MOODLE 3.13.93.11 4.1 LTS4.5 LTS5.05.1 BEFORE local_report 1.x NO LONGER MAINTAINED AFTER TAKEOVER local_report 2.x 1 2UPGRADE 3KEPT PER RELEASE TESTED IN CI
  1. ①Review. What the plugin does, where permission checks are missing, which APIs have been removed.
  2. ②Upgrade to 4.1 LTS with automated tests for every supported version.
  3. ③Then maintenance for every Moodle release, under a maintenance contract if you wish.
Maintenance & development →

SituationAn external tip or a bad feeling: the plugin might contain a vulnerability.

Fig. 1.2: Path of the vulnerability, before and after
Students Plugin Teachers Comment with script Output is filtered FIX before: script runs when opened after: text only 1 2 3
  1. ①A clear finding. Who can trigger the vulnerability and what happens then.
  2. ②A fix in the right place, as a merge request against your repository.
  3. ③With a test, so the vulnerability does not return with the next refactoring.
Security audits →

SituationThe vulnerability is known and fixed. Still open: was it exploited, and who is affected?

Fig. 1.3: Who is affected?
VulnerabilitySTORED XSS, FIXED 2 entries1 AUTHOR 9 affected INCL. 2 TEACHERS Admin sessions: 0 AssessmentFOR MANAGEMENTAND DATA PROTECTION 1 2 3
  1. ①Look for traces instead of guessing. Directly in the database and logs.
  2. ②Narrow down who is affected. Who saw the crafted content, and when?
  3. ③A clear assessment. For management and data protection: what happened and what did not.
Security audits →

SituationMoodle is to move to its own server, with updates, backups and no open doors.

Fig. 1.4: Server setup
Browser YOUR SERVER HTTPS nginxPUBLIC/ ONLY MoodlePHP-FPM DatabaseNOT PUBLIC moodledataOUTSIDE WEB ROOT Updates · Monitoring · Logs BackupOFF-SITE · RESTORE TESTED 1 2 3
  1. ①Only reachable what must be reachable. HTTPS, security headers, no config or backup files on the web.
  2. ②Data separate from code. Uploads outside the web root, database not public.
  3. ③Off-site backups, with restores tested regularly.
Maintenance & operations →

SituationAn assistant is to answer questions about internal documents. Not everyone may see every document.

Fig. 1.5: Path of a question
YOUR DOCUMENTS QuestionPERSON A Search4 HITS Permissions3 OF 4 NO PERMISSION ModelLOCAL OR EU AnswerWITH SOURCES Log: person, question, sources used 1 2 3
  1. ①Permissions before the answer. The assistant only sees what the person is allowed to see.
  2. ②A model to your requirements. Run locally or at a provider in the EU.
  3. ③Traceable. Which sources went into which answer.
AI solutions →

2 / Evidence

How can I tell that you can do this?

45+

vulnerabilities found and reported to the vendors through coordinated disclosure. 24 of them have been published, the rest will follow once each one is fixed.

IDDateSystemFindingSeverity
MSA-26-004222 Sep 2026MoodleBlind SQL injection risk in profile availability condition checkSerious
CVE-2025-4951717 Jun 2025MoodleMissing authorisation checks in BigBlueButton view pageSerious
CVE-2025-364122 Apr 2025MoodleAuthenticated remote code execution risk in the Moodle LMS Dropbox repositorySerious
CVE-2024-3827619 Jun 2024MoodleCSRF risks due to misuse of confirm_sesskeySerious
CVE-2023-666321 Dec 2023MoodleAuthenticated remote code execution risk in course blocksSerious
CVE-2023-2833020 Mar 2023MoodleAuthenticated arbitrary file read through malformed backup fileSerious
Selection, 6 of 24 publishedView all →

3 / Team

Who will I be dealing with?

You speak directly with the people behind madasolis, with no intermediaries.

More about us →
Photo

Vincent Schneider

Managing Director, Development & security

More than 8 years in development and IT security. Combines both in every project and has reported more than 45 vulnerabilities in large open-source systems.

Published vulnerabilities →
Photo

Christian Niemczik

Shareholder

4 / Contact

What happens next?

Describe your project in three short steps. We usually reply within one working day.

Start an inquiry → kontakt@madasolis.de