In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.

In Moodle 3.x, course creators are able to change system default settings for courses.

Moodle 3.x has user fullname disclosure on the user preferences page.

In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.

In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.

In Moodle 3.x, XSS can occur via evidence of prior learning.

In Moodle 3.2.x, global search displays user names for unauthenticated users.

In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

In Moodle 3.x, there is XSS in the assignment submission page.

In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader/assets/uploader.swf.

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf.

SQL injection vulnerability in ing/blocks/mrbs/code/web/view_entry.php in the MRBS plugin for Moodle allows remote attackers to execute arbitrary SQL commands via the id parameter.