Vulnerability Description
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://abraxaslabs.tech/research/moodle-enrol-database-sqli
- https://github.com/moodle/moodle
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-
- https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-
- https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and
FAQ
What is CVE-2026-119554?
CVE-2026-119554 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. E...
How severe is CVE-2026-119554?
CVE-2026-119554 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119554?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.