CVE-2021-20187: Moodle

High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days.

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.

Affected products

• Moodle Moodle: before 3.5.16 (fixed in 3.5.16); from 3.8.0, before 3.8.7 (fixed in 3.8.7); from 3.9.0, before 3.9.4 (fixed in 3.9.4); version 3.10.0 only

Published 2021-01-28. Last modified 2026-06-17.