Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102588— Moodle: csrf in xml grade import

Quick assessment

Affected
CVE-2026-102588
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Moodle 中发现了一个安全漏洞。其 XML 成绩导入功能缺乏适当的跨站请求伪造（CSRF）令牌验证。攻击者可以通过诱骗拥有成绩管理权限的已认证用户访问恶意网页，从而以受害者的身份触发未经授权的请求。该漏洞允许远程攻击者在未获授权的情况下设置或覆盖学生成绩。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-102588

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Moodle: csrf in xml grade import
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 5.2.0 ~ 5.2.2 -

II. Public POCs for CVE-2026-102588

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102588

请登录查看更多情报信息。

Other References for CVE-2026-102588 (4)

IV. Related Vulnerabilities

Same weakness: CWE-346

V. Comments for CVE-2026-102588

No comments yet

Leave a comment