Veille CVE

Recherche « jleyva moodle-block_configurablereports »

2 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « jleyva moodle-block_configurablereports » ✕
  1. CVE-2026-113608 5.3 Moyenne

    jleyva moodle-block_configurablereports

    Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.

  2. CVE-2026-113607 6.5 Moyenne

    jleyva moodle-block_configurablereports

    Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.