Report feedback

Allows an unauthenticated remote attacker, due to insufficient input handling in an undocumented command of the MimeTeX tool, to execute code on a server using this tool through the TeX Notation filter. Support for MimeTeX within Moodle LMS will be discontinued in the near future due to the growing security risk associated with this tool. If an immediate update to the fixed version is not possible, it is recommended to disable the TeX Notation filter. Further details on the vulnerability can be found at [2].

The vulnerability is present in product:

• *:Moodle;>=4.1.0,<4.1.18;>=4.3.0,<4.3.12;>=4.4.0,<4.4.8;>=4.5.0,<4.5.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2024-40446 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2025.

Allows an authenticated remote attacker with teacher or manager privileges, due to a vulnerability in the Dropbox repository plugin, to execute code on the server. If an immediate update to the fixed version is not possible, it is recommended to disable the Dropbox repository via Site Administration -> Plugins -> Repositories -> Manage repositories [3].

The vulnerability is present in product:

• *:Moodle;>=4.1.0,<4.1.18;>=4.3.0,<4.3.12;>=4.4.0,<4.4.8;>=4.5.0,<4.5.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-3641 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2025.

Allows an authenticated remote attacker with teacher or manager privileges, due to a vulnerability in the EQUELLA repository plugin, to execute code on the server. If an immediate update to the fixed version is not possible, it is recommended to disable the EQUELLA repository via Site Administration -> Plugins -> Repositories -> Manage repositories [4].

The vulnerability is present in product:

• *:Moodle;>=4.1.0,<4.1.18;>=4.3.0,<4.3.12;>=4.4.0,<4.4.8;>=4.5.0,<4.5.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-3642 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2025.

Allows an authenticated remote attacker to carry out a DoS attack on the login of another user within multi-factor authentication (MFA) and to display that user's name. The service becomes unavailable if the user uses only e-mail as the second authentication factor [5].

The vulnerability is present in product:

• *:Moodle;>=4.3.0,<4.3.12;>=4.4.0,<4.4.8;>=4.5.0,<4.5.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

More information:

• CVE-2025-3625 at cve.org, NVD
• CWE-639: Authorization Bypass Through User-Controlled Key at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2025.

Allows an unauthenticated remote attacker, using social engineering, to carry out a reflected XSS attack [6].

The vulnerability is present in product:

• *:Moodle;>=4.1.0,<4.1.18;>=4.3.0,<4.3.12;>=4.4.0,<4.4.8;>=4.5.0,<4.5.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

• CVE-2025-3643 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2025.