CVE-2025-3642CWE-94

Moodle: authenticated remote code execution risk in the moodle lms equella repository

High · published April 25, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
63.7
In the wild
Unconfirmed
What it is

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01040 · 63.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-04-25T14:43Z
EPSS history
Timeline
  • 25 APR 14:43Z
    Moodle: authenticated remote code execution risk in the moodle lms equella repository
    cvelistv5