Live › vulnerability › CVE-2026-119554
Editing teachers can store a crafted course idnumber that Moodle's External database enrolment plugin runs as SQL during scheduled sync. On MySQL or MariaDB external databases, an attacker can read data and change enrolment results.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Only sites running Moodle with the External database enrolment plugin enabled and an external MySQL or MariaDB database for enrolment. Editing teachers can trigger the injection, so the risk depends on who can edit course settings. Sites without that plugin or using other databases can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
This page as .md · .json · in your agent: get_signal("CVE-2026-119554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.