These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Configurable Reports block for Moodle before version 5.3.1 contains a SQL injection vulnerability via the filter_var request parameter in viewreport.php. This allows low-privileged users who can view reports using the %%FILTER_VAR%% placeholder to inject subqueries or UNION SELECT statements, potentially reading arbitrary database tables including user password hashes.
The Configurable Reports block for Moodle before version 5.3.0 contains an authorization bypass vulnerability. This allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. The vulnerability arises when the check_permissions function fails, adding a warning but still returning the full report table. This enables any logged-in user to supply [truncated]