CVE-based security audit of open-source learning management systems in higher education using CVSS and OWASP
Melissa T. Guillermo, Eduardo R. Yu II & Reagan B. Ricafort
Abstract
This study examined publicly disclosed Common Vulnerabilities and Exposures (CVE) records for Moodle, Chamilo, Canvas LMS, Open edX, and Sakai to assess their value for higher education security governance. A non-intrusive secondary-data audit analyzed 236 CVEs from 2018 to 3 June 2026 using platform, National Vulnerability Database (NVD) Published Date year, revised CVSS severity categories, and OWASP Top 10:2021 classifications. Six zero-score records were separated from low severity. A sensitivity analysis compared the full corpus with 211 NVD API-verified records. A blinded independent IT-faculty coder recoded 24 records; severity agreement was 100.0% (Cohen's kappa = 1.000), and OWASP agreement was 91.7% (Cohen's kappa = 0.814). Moodle and Chamilo represented 91.5% of the corpus, a disclosure-weighted pattern rather than a product ranking. A03 Injection (54.2%) and A01 Broken Access Control (31.4%) dominated. Among records with numeric CVSS scores, including six zero-score records, high/critical proportions were 45.3% (67/148) in the full corpus and 44.9% (66/147) in the NVD-verified subset. Canvas and Sakai findings were interpreted cautiously because of small denominators. Public CVE evidence is affected by disclosure asymmetry, incomplete CVSS metadata, NVD non-returned records, and deployment differences. Because identifiable CVSS version/vector metadata were not preserved, severity comparisons are descriptive rather than version-normalized. The audit offers a reproducible governance framework linking vulnerability patterns to patching, authorization review, content-ingestion controls, plugin governance, and supplier accountability without treating raw CVE counts as inherent security rankings.
Keywords
cybersecurity governance, common vulnerabilities and exposures, cybersecurity, vulnerability assessment, OWASP, web application security
Author information & Contribution
Melissa T. Guillermo. Corresponding author. Master of Science in Computer Science. Assistant Professor I, Dr. Filemon C. Aguilar Memorial College of Las Piñas, Las Piñas City, Philippines. Email: mrenrose@gmail.com
Eduardo R. Yu II. Doctor of Information Technology, Licensed Professional Teacher, software engineer, and part-time faculty member. AMA University, Philippines. Email: eduardoryuii@gmail.com
Reagan B. Ricafort. Doctor of Information Technology. Professor/faculty member, AMA University, Philippines. Email: reagan072001@gmail.com
"Melissa T. Guillermo conceptualized the study, curated the dataset, performed the formal analysis, and drafted the manuscript. Reagan B. Ricafort and Eduardo R. Yu II reviewed the methodology, validated the analysis, revised the manuscript for important intellectual content, and supported project administration. All authors contributed to the final version of the manuscript, read and approved the final manuscript, and agree to be accountable for the accuracy and integrity of the work."
Disclosure statement
No potential conflict of interest was reported by the authors.
Funding
This work was not supported by any funding.
Institutional Review Board Statement
Not Applicable
Data and Materials Availability
The data supporting the findings of this study are available from the corresponding author upon reasonable request.
AI Declaration
The authors declare the use of Artificial Intelligence (AI) in preparing this paper. In particular, the authors used ChatGPT for grammar checking, language clarity, low-intervention paraphrasing, formatting review, and consistency checking of manuscript sections. The tool was not used to fabricate data, generate the CVE dataset, create unsupported findings, or replace the authors’ interpretation of the results. Python was also used as a research-support and data-processing tool for organizing the CVE dataset, checking record counts, computing descriptive statistics and percentages, preparing tables, and generating figures used in the manuscript. The authors take full responsibility for reviewing, verifying, and editing all AI-assisted and software-supported outputs.
Notes
Acknowledgement
References
Abdelkader, M. A., Mazen, S. A., & Helal, I. M. A. (2025). Implementation and evaluation of a proposed framework for auditing learning management systems in an Egyptian university. International Journal of Computer Information Systems and Industrial Management Applications, 17, 746-764. https://doi.org/10.70917/ijcisim-2025-0045
Agalit, M. A., Chakir, E. M., Issam, T., & Khamlichi, Y. I. (2023). A review of cybersecurity management standards applied in higher education institutions. International Journal of Safety and Security Engineering, 13(6), 1109-1116. https://doi.org/10.18280/ijsse.130614
Akacha, S. A., & Awad, A. I. (2023). Enhancing security and sustainability of e-learning software systems: A comprehensive vulnerability analysis and recommendations for stakeholders. Sustainability, 15(19), 14132. https://doi.org/10.3390/su151914132
Apte, T., & Sharma, S. (2021). Progression in cyber security concerns for learning management systems: Analyzing the role of participants. In V. Bali, V. Bhatnagar, D. Aggarwal, S. Bali, & M. J. Sousa (Eds.), Cyber-physical, IoT, and autonomous systems in Industry 4.0. CRC Press. https://doi.org/10.1201/9781003146711
Aslan, O., Aktug, S. S., Okay, M. O., Yilmaz, A. A., & Akin, E. (2023). A comprehensive review of cyber security vulnerabilities, threats, attacks, and solutions. Electronics, 12(6), 1333. https://doi.org/10.3390/electronics12061333
Balsam, A., Nowak, M., Walkowski, M., Oko, J., & Sujecki, S. (2024). Comprehensive comparison between versions CVSS v2.0, CVSS v3.x and CVSS v4.0 as vulnerability severity measures. In 2024 24th International Conference on Transparent Optical Networks (ICTON). IEEE. https://doi.org/10.1109/ICTON62926.2024.10647452
Banes, V., Ravariu, C., Appasani, B., & Srinivasulu, A. (2023). A novel two-factor authentication scheme for increased security in accessing the Moodle e-learning platform. Applied Sciences, 13(17), 9675. https://doi.org/10.3390/app13179675
Ben Fredj, O., Cheikhrouhou, O., Krichen, M., Hamam, H., & Derhab, A. (2020). An OWASP Top Ten driven survey on web application protection methods. In J. Garcia-Alfaro, J. Leneutre, N. Cuppens, & R. Yaich (Eds.), Risks and security of Internet and systems (pp. 235-252). Springer. https://doi.org/10.1007/978-3-030-68887-5_14
Federal Bureau of Investigation. (2026, May 15). ShinyHunters: Cyber criminal group attacks learning management system (Alert No. I-051526-PSA). Internet Crime Complaint Center. https://www.ic3.gov/PSA/2026/PSA260515
Federal Student Aid. (2026, May 12). Technology security alert—Ongoing cybersecurity incident involving the Canvas Learning Management System (GENERAL-26-27). U.S. Department of Education. https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-05-12/technology-security-alert-ongoing-cybersecurity-incident-involving-canvas-learning-management-system-updated-may-29-2026
Forum of Incident Response and Security Teams. (2023). Common Vulnerability Scoring System version 4.0: Specification document. https://www.first.org/cvss/v4.0/specification-document
International Organization for Standardization. (2022a). Information security, cybersecurity and privacy protection – Information security management systems – Requirements (ISO/IEC 27001:2022). https://www.iso.org/standard/27001
International Organization for Standardization. (2022b). Information security, cybersecurity and privacy protection – Information security controls (ISO/IEC 27002:2022). https://www.iso.org/standard/75652.html
Kasmawi, Hidayasari, N., & Mansur. (2023). Vulnerability analysis using OWASP ZAP on higher education websites. AIP Conference Proceedings, 2665(1), 030015. https://doi.org/10.1063/5.0153145
MITRE Corporation. (n.d.). CVE Program. https://www.cve.org/
Moodle. (2026). Vulnerability scans. https://docs.moodle.org/502/en/Vulnerability_scans
Mora Secaira, J., Díaz Ocampo, R., & Samaniego Mena, E. (2023). Analysis of risks and vulnerabilities in a university-level LMS system. Migration Letters, 20(S8), 1252-1262. https://www.migrationletters.com/index.php/ml/article/view/5090
National Institute of Standards and Technology. (n.d.). National Vulnerability Database. https://nvd.nist.gov/
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
Nuhi, A., Ajruli, N., Idrizi, F., Imeri, F., & Memeti, A. (2025). Securing MVC-based LMS platforms: Addressing authentication, XSS, and injection vulnerabilities. Journal of Natural Sciences and Mathematics of UT, 10(19-20), 312-321. https://doi.org/10.62792/ut.jnsm.v10.i19-20.p3198
Open Web Application Security Project. (2021). OWASP Top 10:2021 – The ten most critical web application security risks. https://owasp.org/Top10/
Piazza, A., Vasudevan, S., & Carr, M. (2023). Cybersecurity in UK universities: Mapping (or managing) threat intelligence sharing within the higher education sector. Journal of Cybersecurity, 9(1), tyad019. https://doi.org/10.1093/cybsec/tyad019
Robert, J., Muscanell, N., Arbino, N., McCormack, M., & Reeves, J. (2024). 2024 EDUCAUSE Horizon Report: Cybersecurity and Privacy Edition. EDUCAUSE. https://library.educause.edu/resources/2024/9/2024-educause-horizon-report-cybersecurity-and-privacy-edition
Rossi, D., Bressan, L., Campos, F., Oliveira, A., & Stroele, V. (2023). Educational software and security vulnerabilities: An experimental study. In Anais do XXXIV Simposio Brasileiro de Informatica na Educacao (pp. 264-276). SBC. https://doi.org/10.5753/sbie.2023.234860
Sadiqzade, Z., & Alisoy, H. (2025). Cybersecurity and online education: Risks and solutions. Luminis Applied Science and Engineering, 2(1), 4-12. https://doi.org/10.69760/lumin.20250001001
Scarfone, K., Souppaya, M., & Dodson, D. (2022). Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities (NIST SP 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218
Shabbir, A., Deraman, A., Hassan, M. N. B., Sarker, K. U., & Kamal, S. (2025). Prioritizing non-functional requirements and influencing factors for API quality framework: An industry approach. International Journal of Advanced Computer Science and Applications, 16(9). https://doi.org/10.14569/IJACSA.2025.0160934
Shabbir, A., Deraman, A., Hassan, M. N. B., Sarker, K. U., & Kamal, S. (2026). Enhancing API quality: A comprehensive review of non-functional requirements for quality-centric framework development. KSII Transactions on Internet and Information Systems, 20(2), 853–875. https://doi.org/10.3837/tiis.2026.02.011
Souppaya, M., & Scarfone, K. (2022). Guide to enterprise patch management planning: Preventive maintenance for technology (NIST SP 800-40 Rev. 4). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-40r4
Wunder, J., Kurtz, A., Eichenmuller, C., Gassmann, F., & Benenson, Z. (2024). Shedding light on CVSS scoring inconsistencies: A user-centric study on evaluating widespread security vulnerabilities. In 2024 IEEE Symposium on Security and Privacy (pp. 1102-1121). IEEE. https://doi.org/10.1109/SP54263.2024.00058
Cite this article:
Guillermo, M.T., Yu, E.R. & Ricafort, R.B. (2026). CVE-based security audit of open-source learning management systems in higher education using CVSS and OWASP. International Journal of Science, Technology, Engineering and Mathematics, 6(3), 1-26. https://doi.org/10.53378/ijstem.353374
License:
This work is licensed under a Creative Commons Attribution (CC BY 4.0) International License.
Find this article in:
Most read articles in this journal
- Analysis of the inventory management system towards enhanced university service delivery
- Street food’s microbiological load and vendors’ food hygiene and safety practices compliance in the schools of Cebu City
- Assessing students’ mastery and misconceptions in the fundamental operations on integers
- Leafina: Potency of Kakawate leaves, fishbone meal and saba banana peel compost soil amendment to the water holding capacity of loam soil
- Problem-based learning strategies and critical thinking skills among pre-service teachers
- Eating habits, nutrition literacy, and mathematics performance of junior high school students
- Effectiveness of project COUNTS in improving students’ numeracy skills
- Exploring students’ procedural fluency and written adaptive reasoning skills in solving open-ended problems
- Compressive strength and cost analysis of concrete hollow blocks with upcycled plastics as replacement for choker aggregates
- Transforming SME operations with real-time mobile POS and Firebase integration