CVE-2026-119554— Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber

Quick assessment

Affected

Moodle Project moodle

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Moodle 5.3.0、5.2.0 至 5.2.4、5.1.0 至 5.1.8、5.0.0 至 5.0.11 以及 4.5.15 及更早版本的外部数据库注册插件中，存在一个通过课程 idnumber 参数引发的 SQL 注入漏洞。编辑教师可在 idnumber 中存储包含反斜杠和引号的攻击载荷，该载荷在 MySQL/MariaDB 外部数据库执行定时同步时会被触发，从而导致数据泄露及注册结果被篡改。

CVSS 5.9 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber

Source: CVE Program / CVE List V5

Vulnerability Description

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Moodle Project	moodle	5.3.0	-

II. Public POCs for CVE-2026-119554

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119554

请登录查看更多情报信息。

Other References for CVE-2026-119554 (6)

https://abraxaslabs.tech/research/moodle-enrol-database-sqli third-party-advisory
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L918-L926 technical-description
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L971-L979 technical-description
https://github.com/moodle/moodle product
https://github.com/moodle/moodle/blob/v5.3.0/public/enrol/database/lib.php#L527-L528 technical-description
https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-sql-injection-via-enrol-database-course-idnumber third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119554

Same Patch Batch · Moodle Project · 2026-10-30 · 4 CVEs total

CVE-2026-119553	6.5 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
CVE-2026-119555	4.3 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grad
CVE-2026-119556	4.3 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grade

IV. Related Vulnerabilities

Same product: moodle

Same vendor: Moodle Project

Same weakness: CWE-89