CVE-2026-102578

HighCVSS 8.8/10Last modified Oct 1, 2026

Description

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
——>= 5.2.0, < 5.2.2; >= 5.1.0, < 5.1.6; >= 5.0.0, < 5.0.9; < 4.5.13

References

Timeline

Published
Sep 30, 2026
Last modified
Oct 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1025794.3A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile informaCVE-2026-102586.3A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/add_sub_topCVE-2026-1025804.3A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder componentCVE-2026-1025815.4A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSSCVE-2026-1025824.3A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, alCVE-2026-1025832.7A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web servicCVE-2026-1025844.3A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade peCVE-2026-1025854.3A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether theCVE-2026-1025866.1A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a croCVE-2026-1025872.7A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user witCVE-2026-1025886.5A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an autCVE-2026-102598.8A security vulnerability has been detected in H3C Magic B0 up to 100R002. The affected element is the function SetMobileAPInfoById of the fi
CVE-2026-102578: High severity, CVSS 8.8 | Vulnix