Threat Intelligence Database

CVE-2026-102588 is a medium severity vulnerability in Moodle's XML grade import feature. The flaw is due to missing Cross-Site Request Forgery (CSRF) token validation, allowing an attacker to trick an authenticated user with grade management permissions into performing unauthorized grade modifications. This can lead to unauthorized setting or overwriting of student grades remotely.

CVE-2026-102587 is a low-severity vulnerability in Moodle where user list filters do not properly enforce visibility restrictions on user profile fields. This allows authorized users with manager privileges to filter user lists by profile attributes they are not allowed to view directly, potentially disclosing hidden user information through inference.

CVE-2026-102586 is a cross-site scripting (XSS) vulnerability in Moodle caused by insufficient sanitization of username input on the password reset page. This flaw allows a remote attacker to craft a malicious password reset link that, when accessed by an unauthenticated user, can execute arbitrary scripts in the victim's browser. The vulnerability has a medium severity rating with a CVSS score of 4.3.

CVE-2026-102585 is a medium severity vulnerability in Moodle where an authenticated user with teacher privileges can enroll users into groups that do not belong to the course they are managing. This occurs because the application does not verify group ownership during enrollment. The flaw allows unauthorized group assignments but does not impact confidentiality or availability.

CVE-2026-102584 is a vulnerability in Moodle where a missing capability check allows a low-privileged authenticated user to trigger recalculation of grade penalties without proper permissions. This can lead to unauthorized modification of grade penalty records and potentially alter student assessment scores. The vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-102583 is a vulnerability in Moodle involving an incorrect capability check in the AI editor placement's image generation web service. This flaw allows authenticated users without the required permissions to access and use the AI image generation feature. The vulnerability has a low severity score and does not impact confidentiality or availability but may allow limited unauthorized functionality use.

CVE-2026-102582 is a low-severity vulnerability in Moodle where the manual enrolment management page does not properly verify if the manual enrolment plugin is disabled. This allows users with enrolment permissions to access and manage manual enrolments directly via the URL, even if the feature is disabled in the user interface.

CVE-2026-102581 is a stored cross-site scripting (XSS) vulnerability in Moodle caused by insufficient output escaping in templates displaying forum posts. This flaw allows an attacker to inject malicious scripts into forum posts, which execute in the browsers of users viewing those posts. The vulnerability has a medium severity rating with a CVSS score of 4.6.

CVE-2026-102580 is a low-severity vulnerability in Moodle's Report Builder component where an authenticated attacker can supply an improperly validated class name, leading to arbitrary class instantiation. This unsafe reflection flaw allows unauthorized creation of internal program objects, potentially causing unexpected application behavior. The vulnerability requires high privileges and no user interaction. There is no explicit patch information provided in the available data.

CVE-2026-102579 is a vulnerability in Moodle where an incorrect capability check in the grade web service allows authenticated students to access profile information of other students in the same course without proper authorization. This leads to unauthorized disclosure of private personal information. The issue has a medium severity with a CVSS score of 4.3. No specific affected versions or patch information is provided in the available data.