SQL Injection

Every one of the 25 is a mark on the map. Named now: 1 to 25, most at risk first.

1. In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.CVE-2021-36393Moodle · 52% likely

   CWE-89

2. A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.CVE-2022-0332Moodle · 32% likely

   CWE-89

3. In Moodle 2.x and 3.x, SQL injection can occur via user preferences.CVE-2017-2641Moodle · 15% likely

   CWE-89

4. SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogE…CVE-2006-4785Moodle · 3.0% likely

   CWE-89

5. Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the…CVE-2016-7919Moodle · CVSS 7.5 · 2.2% likely

   CWE-89

6. Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted comments operations.CVE-2011-4292Moodle · 2.0% likely

   CWE-89

7. SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors re…CVE-2009-4305Moodle · 1.9% likely

   CWE-89

8. Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the…CVE-2010-1615Moodle · 1.7% likely

   CWE-89

9. SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute arb…CVE-2012-3395Moodle · 1.6% likely

   CWE-89

10. SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands…CVE-2012-2363Moodle · 1.4% likely

    CWE-89

11. A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.CVE-2022-30599Moodle · 1.4% likely

    CWE-89

12. In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5…CVE-2020-25700Moodle · 1.3% likely

    CWE-89

13. Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers…CVE-2013-4313Moodle · 1.2% likely

    CWE-89

14. Moodle: authenticated sql injection via availability checkCVE-2023-28329Moodle · CVSS 6.3 · 1.2% likely

    CWE-89

15. SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and…CVE-2008-6124Moodle · 1.2% likely

    CWE-89

16. Moodle: minor sql injection risk in external wiki method for listing pagesCVE-2023-30944Moodle · CVSS 5.6 · 1.1% likely

    CWE-89

17. A limited SQL injection risk was identified in the "browse list of users" site administration page.CVE-2022-40315Moodle · CVSS 9.8 · 1.1% likely

    CWE-89

18. An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or acc…CVE-2021-32474Moodle · 0.9% likely

    CWE-89

19. An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.CVE-2022-0983Moodle · 0.9% likely

    CWE-89

20. In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.CVE-2021-36392Moodle · 0.8% likely

    CWE-89

21. Moodle: minor sql injection risk on mnet sso access control pageCVE-2023-35132Moodle · CVSS 6.3 · 0.8% likely

    CWE-89

22. Moodle: site administration sql injection via xmldb editorCVE-2024-43436Moodle · CVSS 7.2 · 0.8% likely

    CWE-89

23. SQL injection risk in course search module list filterCVE-2025-26533Moodle Project · CVSS 8.1 · 0.6% likely

    CWE-89

24. Moodle: sql injection in question bank web serviceCVE-2026-102578Moodle · CVSS 5.5 · 0.3% likely

    CWE-89

25. Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumberCVE-2026-119554Moodle Project · CVSS 5.9 · 0.2% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.