Path
Home / Security
Reported
45+, of which 24 published
Procedure
Coordinated disclosure
Audits
Pentest, Code audit, Hardening

More than 45 vulnerabilities found and reported in coordinated disclosure.

Request an audit → To the list ↓

We examine large open-source systems, report findings through the projects' official security processes and apply this knowledge to every piece of software we build or review.

1Published vulnerabilities

All published advisories. Further reports appear only once the respective fix is available.

24published, with CVE or MSA
9fixed, to be published with the next Moodle release
8in triage at Moodle
7+reported to ILIAS
IDDateSystemFindingSeverity
MSA-26-004222 Sep 2026MoodleBlind SQL injection risk in profile availability condition checkSerious
MSA-26-00419 Sep 2026MoodleCSRF risk in XML grade importsSerious
CVE-2026-727829 Apr 2026MoodleCSRF and missing capability check in admin/mnet/peers.phpMinor
CVE-2025-4951717 Jun 2025MoodleMissing authorisation checks in BigBlueButton view pageSerious
CVE-2025-4951617 Jun 2025MoodleCSRF risk in badges backpack managementMinor
CVE-2025-4951517 Jun 2025MoodleCourse visibility not honoured consistentlySerious
CVE-2025-364222 Apr 2025MoodleAuthenticated remote code execution risk in the Moodle LMS EQUELLA repositorySerious
CVE-2025-364122 Apr 2025MoodleAuthenticated remote code execution risk in the Moodle LMS Dropbox repositorySerious
CVE-2025-363822 Apr 2025MoodleCSRF risk in Brickfield tool's analysis request actionMinor
CVE-2025-363622 Apr 2025MoodleIDOR in RSS block allows access to additional RSS feedsMinor
CVE-2025-363522 Apr 2025MoodleCSRF risk in user tours manager allows tour duplicationMinor
CVE-2025-2652818 Feb 2025MoodleStored XSS in ddimageortext question typeMinor
CVE-2024-5564517 Dec 2024MoodleEmail change confirmation token available via preferenceMinor
CVE-2024-3827619 Jun 2024MoodleCSRF risks due to misuse of confirm_sesskeySerious
CVE-2024-3400513 May 2024MoodleAuthenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupSerious
CVE-2024-3400413 May 2024MoodleAuthenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupSerious
CVE-2024-3400313 May 2024MoodleAuthenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backupSerious
CVE-2024-3400213 May 2024MoodleAuthenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupSerious
CVE-2023-666321 Dec 2023MoodleAuthenticated remote code execution risk in course blocksSerious
CVE-2023-666121 Dec 2023MoodleAuthenticated remote code execution risk in logstore as managerSerious
CVE-2023-554017 Oct 2023MoodleAuthenticated remote code execution risk in IMSCPSerious
CVE-2023-553917 Oct 2023MoodleAuthenticated remote code execution risk in LessonSerious
CVE-2023-2833020 Mar 2023MoodleAuthenticated arbitrary file read through malformed backup fileSerious
CVE-2023-2832920 Mar 2023MoodleAuthenticated SQL injection via availability checkSerious
24 published, as of 16 Oct 2026Source: moodle.org/security →

2How a report proceeds

We publish nothing before the operators of a system have a fix.

  1. 2.1

    Finding

    Analysis on our own test system, never on third-party production instances.

  2. 2.2

    Report

    Confidentially via the project's security tracker, with reproduction steps and a proposed fix.

  3. 2.3

    Fix

    The project fixes the vulnerability and ships updates. On request, we verify the patch.

  4. 2.4

    Publication

    Only then are the CVE and details published, by the project and here in the list.

3What this means for your project

We check for the bug classes from our findings in every project we build or audit.

~/your-project
$ review src/
[*] Permission check per endpoint
[*] Inputs and outputs
[*] File and database access
[*] Sessions, CSRF, redirects
[+] Findings with severity and proposed fix
[✓] Re-test after the fix

For third-party code, we offer this as a separate security audit: pentest, code audit or both.

4 / Contact

Should someone review your application?

Describe your project in three short steps. We usually reply within one working day.

Start an inquiry → kontakt@madasolis.de