Medium · published September 30, 2026
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.
| Product | Versions | Fixed in |
|---|---|---|
| moodle/moodle | < 4.5.13 | 4.5.13 |
| moodle/moodle | ≥ 5.0.0, < 5.0.9 | 5.0.9 |
| moodle/moodle | ≥ 5.1.0, < 5.1.6 | 5.1.6 |
| moodle/moodle | ≥ 5.2.0, < 5.2.2 | 5.2.2 |