CVE-2026-119554

EUVD-2026-113819
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.9 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
moodlemoodle
5.3.0
CNA
moodlemoodle
5.2.0 ≤
𝑥
≤ 5.2.4
CNA
moodlemoodle
5.1.0 ≤
𝑥
≤ 5.1.8
CNA
moodlemoodle
5.0.0 ≤
𝑥
≤ 5.0.11
CNA
moodlemoodle
𝑥
≤ 4.5.15
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/moodle-enrol-database-sqli
https://github.com/moodle/moodle
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-L528
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-L926
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-L979
https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-sql-injection-via-enrol-database-course-idnumber