Description

login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.

Remediation

References

CVE-2015-3179

Related Vulnerabilities

WordPress Plugin WP Session Manager SQL Injection (1.2.1)

WordPress Plugin Users to CSV Cross-Site Request Forgery (1.4.5)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-4604)

WebLogic CVE-2016-0700 Vulnerability (CVE-2016-0700)

Ruby on Rails Improper Verification of Intent by Broadcast Receiver Vulnerability (CVE-2026-33173)

Severity

Low

Classification

CVE-2015-3179 CWE-264

Tags

Missing Update Known Vulnerabilities