← All credits

Upstream acknowledges Paul Holden as the original reporter.

7 vulnerability records and advisories credit this contributor.

CVE-2026-102584

Moodle: missing capability check allows unauthorised grade penalty recalculation

CVE-2026-102585

Moodle: group validation missing when enrolling user to course

CVE-2026-102580

Moodle: arbitrary class instantiation via report builder audience classname

CVE-2026-102582

Moodle: manual enrolment page accessible when plugin disabled

CVE-2026-102583

Moodle: incorrect capability check in ai generate image web service

Moodle: minor sql injection risk in external wiki method for listing pages

Moodle: possible to set the preferred "start page" of other users