CVE-2026-102578

Katalog CVE

CVSS 8.8 · High EPSS 0,30%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada moodle. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Rincian

Terbit di NVD

30 September 2026

Terakhir diubah

1 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://moodle.org/mod/forum/discuss.php?d=482496 advisory vendor
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89383 patch
• https://access.redhat.com/security/cve/CVE-2026-102578 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2543632 issue tracking · advisory pihak ketiga