CVE-2025-62400

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-624014.3An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowe CVE-2025-624025.4API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the e CVE-2025-624037.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-624048.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-624058.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-624068.8Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows send CVE-2025-624076.1Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument CVE-2025-624085.9c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer(CVE-2025-624097.5Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can CVE-2025-62414.4LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default instal CVE-2025-624109.4In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in CVE-2025-624114.8LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulne