Cyber Resilience

CVE-2025-26533

High

Published: 24 February 2025

Published
24 February 2025
Modified
06 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0040 61.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26533 is a high-severity SQL Injection (CWE-89) vulnerability in Moodle Moodle. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-26533 is an SQL injection vulnerability (CWE-89) identified in the module list filter within the course search functionality of Moodle. Published on 2025-02-24, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential impacts on confidentiality, integrity, and availability.

The vulnerability can be exploited by a remote, unauthenticated attacker over the network, requiring high attack complexity but no user interaction. Successful exploitation allows the attacker to manipulate SQL queries, potentially leading to unauthorized data access, modification, or denial of service consistent with the high impact ratings across confidentiality, integrity, and availability.

Mitigation details are available in Moodle's git repository, specifically via commits associated with tracker issue MDL-84271, and further discussion on the Moodle forum thread. Security practitioners should review these references for patch application guidance.

EU & UK References

Vulnerability details

An SQL injection risk was identified in the module list filter within course search.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing Moodle web application directly enables remote exploitation of internet-facing software per T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-26530Same product: Moodle Moodle
CVE-2025-67850Same product: Moodle Moodle
CVE-2025-67853Same product: Moodle Moodle
CVE-2025-26525Same product: Moodle Moodle
CVE-2026-26046Same product: Moodle Moodle
CVE-2025-26529Same product: Moodle Moodle
CVE-2026-26045Same product: Moodle Moodle
CVE-2025-67848Same product: Moodle Moodle
CVE-2025-67847Same product: Moodle Moodle
CVE-2021-47857Same product: Moodle Moodle

Affected Assets

moodle
moodle
4.1.0 — 4.1.16 · 4.3.0 — 4.3.10 · 4.4.0 — 4.4.6

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection in the module list filter by requiring validation of course search inputs at system entry points.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of the SQL injection flaw via patching as detailed in Moodle's MDL-84271 commits.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning to identify SQL injection risks like CVE-2025-26533 in Moodle's course search functionality for timely remediation.

References