Description

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.

Remediation

References

CVE-2025-62400

Related Vulnerabilities

Liferay DXP Incorrect Default Permissions Vulnerability (CVE-2022-42130)

WordPress Plugin CPT Bootstrap Carousel Cross-Site Scripting (1.12)

WordPress Plugin PHP Event Calendar for WordPress Arbitrary File Upload (1.6)

Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2025-25226)

RubyGems Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-8323)

Severity

Medium

Classification

CVE-2025-62400 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities