CVE-2026-102588
A flaw was found in Moodle
- Risk score
- 41/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remot…
- Affected
- Moodle
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Moodle: Yellow, plan it in. A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in t…
The flaws
- CVE-2026-102588: A flaw was found in Moodle (CVSS 6.5 · EPSS 0%)
- CVE-2026-102578: SQL injection (CVSS 8.8 · EPSS 0%)
- CVE-2026-102586: Cross-site scripting (CVSS 6.1 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Moodle
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-346 (CWE-346). 55 other warnings in 30 days
- Same product: Earlier Moodle warnings. 9 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
References
Original description
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
Last activity 30 Sep 2026. Patch Forecast updates every hour.