CVE-2016-3734

Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.

• CWE-352

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53755Patch
• http://www.openwall.com/lists/oss-security/2016/05/17/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/91281Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1035902Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1335933Issue Tracking, Third Party Advisory
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53755Patch
• http://www.openwall.com/lists/oss-security/2016/05/17/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/91281Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1035902Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1335933Issue Tracking, Third Party Advisory

Published

Apr 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3728Eval injection vulnerability in tftp_api.rb in the TFTP modu…
• CVE-2016-3729The user editing form in Moodle 3.0 through 3.0.3, 2.9 throu…
• CVE-2016-3730Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-3731Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through…
• CVE-2016-3732The capability check to access other badges in Moodle 3.0 th…
• CVE-2016-3733The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2…
• CVE-2016-3735Piwigo is image gallery software written in PHP. When a crit…8.1
• CVE-2016-3736Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-3737The server in Red Hat JBoss Operations Network (JON) before …
• CVE-2016-3738Red Hat OpenShift Enterprise 3.2 does not properly restrict …
• CVE-2016-3739The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c an…
• CVE-2016-3740Heap-based buffer overflow in the CreateFXPDFConvertor funct…