CVE-2014-3541
HighSummary
The Repositories component in Moodle through 2.3.11, and in versions 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially gaining control over the Moodle system and accessing sensitive data.
Recommendation
It is recommended to update Moodle to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in Repositories
See all- CVE-2026-66375High
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
- CVE-2025-13488Medium
Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.
Original NVD description (English source)
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS