Description
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
Remediation
References
Related Vulnerabilities
WordPress Plugin Contact Form by BestWebSoft Cross-Site Scripting (3.51)
MySQL CVE-2016-0610 Vulnerability (CVE-2016-0610)
Python CVE-2026-15308 Vulnerability (CVE-2026-15308)
Jenkins Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-3666)
WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2016-6635)