medium5.5
CVE-2026-102578
A flaw was found in Moodle.
Impact
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | before 4.5.13 from 5.0.0 before 5.0.9 from 5.1.0 before 5.1.6 from 5.2.0 before 5.2.2 |