CVE-2025-62401
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
Risk Assessment
Students can gain an unfair advantage by extending assignment time, undermining assessment integrity. This can lead to unfair grades and reduced trust in the e-learning platform.
Recommendation
Update Moodle to a version that includes the fix for this issue. Monitor assignment logs and consider reviewing assessment results if exploitation is suspected.
Other vulnerabilities in Moodle
See all- CVE-2016-7038High
In Moodle versions 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
- CVE-2015-5267High
In Moodle through version 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2, the random_string and complex_random_string functions rely on the PHP mt_rand function, making it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
- CVE-2015-3272High
The clean_param function in lib/moodlelib.php in Moodle has an open redirect vulnerability that allows remote attackers to redirect users to arbitrary websites.
- CVE-2014-7845High
The generate_password function in Moodle through 2.4.11, and in versions 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, allowing remote attackers to gain access via a brute-force attack.
- CVE-2017-2641Critical
In Moodle versions 2.x and 3.x, SQL injection vulnerability can occur via user preferences.
- CVE-2026-123655High
A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This results in unauthorized information disclosure of protected content.
- CVE-2026-119556Medium
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
- CVE-2026-119555Medium
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.
- CVE-2026-119554Medium
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
- CVE-2026-119553Medium
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Original NVD description (English source)
An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS