https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:30:23 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-10235 bdu:2025-10235 https://cve.radiocsirt.org/vuln/bdu:2025-10235 https://cve.radiocsirt.org/vuln/bit-moodle-2025-53021 <p><strong>Affected:</strong> Bitnami: moodle</p> <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> <p><strong>Affected:</strong> Bitnami: moodle</p> <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> https://cve.radiocsirt.org/vuln/bit-moodle-2025-53021 https://cve.radiocsirt.org/vuln/euvd-2026-245784 EUVD-2026-245784 https://cve.radiocsirt.org/vuln/euvd-2026-245784 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53021 <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-53021 https://cve.radiocsirt.org/vuln/ghsa-cgvv-3455-824j <p><strong>Affected:</strong> Packagist: moodle/moodle</p> <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> <p><strong>Affected:</strong> Packagist: moodle/moodle</p> <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> https://cve.radiocsirt.org/vuln/ghsa-cgvv-3455-824j https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-53021 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: moodle, Ubuntu:Pro:18.04:LTS: moodle</p> <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: moodle, Ubuntu:Pro:18.04:LTS: moodle</p> <p>A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim&#39;s session being linked to the attacker&#39;s. Successful exploitation results in full account takeover. According to the Moodle Releases page, &#34;Bug fixes for security issues in 3.11.x ended 11 December 2023.&#34; NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-53021 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1391 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1391