CVE-2026-102578: Moodle

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Affected products

• Moodle Moodle: before 4.5.13 (fixed in 4.5.13); from 5.0.0, before 5.0.9 (fixed in 5.0.9); from 5.1.0, before 5.1.6 (fixed in 5.1.6); from 5.2.0, before 5.2.2 (fixed in 5.2.2)

Published 2026-09-30. Last modified 2026-10-01.