CVE-2026-102578 — Moodle: sql injection in question bank web service
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQ…
Published: 2026-09-30 · CVSS: 5.5 · CVSS 3.1
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7