CVE-2015-5331: Moodle

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.

Affected products

• Moodle Moodle: version 2.9.0 only; version 2.9.1 only; version 2.9.2 only

Published 2016-02-22. Last modified 2026-06-17.