According to its self-reported version, the Moodle install hosted on the remote host is prior to 4.1.10, or 4.2.x prior to 4.2.7 or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple vulnerabilities.

- Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

- The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.

- ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

- Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.

- Additional sanitizing was required when opening the equation editor, to prevent a stored XSS risk when editing another user's equation.

- Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk
    when interacting with some features. (CVE-2024-33998)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk     when interacting with some features. (CVE-2024-33998)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
114726	Moodle < 4.1.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
114727	Moodle 4.2.x < 4.2.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
114728	Moodle 4.3.x < 4.3.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	high
420625	SCA: security update for moodle/moodle (GHSA-xqhh-253w-4q5f)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	medium
420625	SCA: security update for moodle/moodle (GHSA-xqhh-253w-4q5f)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	medium
261489	Linux Distros Unpatched Vulnerability : CVE-2024-33998	Nessus	Misc.	9/5/2025	9/5/2025	medium

Detections

Analytics

Plugins Search

high

high

high

medium

medium

medium