CVE-2026-102578 PUBLISHED

Moodle: sql injection in question bank web service

Assigner: fedora
Reserved: 29.09.2026 Published: 30.09.2026 Updated: 30.09.2026

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS Score: 5.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Package Collection	https://git.moodle.org
Package Name	moodle
Versions	Default: unaffected affected from 5.2.0 to 5.2.2 (excl.) affected from 5.1.0 to 5.1.6 (excl.) affected from 5.0.0 to 5.0.9 (excl.) affected from 0 to 4.5.13 (excl.)

Credits

Upstream acknowledges Caveeroo as the original reporter.

References

Problem Types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE