CVE-2018-14630

PoC ×2—

CVSS 3.0

8.8 high

EPSS

4%p91

Published

Sep 17, 2018 (Sep 17, 2018)

Modified

Jun 17, 2026

Description

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

Vendors: moodle
Products: moodle
Weakness: CWE-20, CWE-94
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.4%)

In the news0 stories

No ingested article mentions this CVE yet.