Live › vulnerability › CVE-2026-113683
Go to dashboardVPL (Virtual Programming Lab) for Moodle before 5.0.0 does not encode the filename1 and filename2 parameters in similarity/diff.php. An attacker can send a crafted diff.php link that runs script in the browser of a user with the mod/vpl:similarity capability, letting it act or read data under that user's session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Moodle sites running the VPL (Virtual Programming Lab) plugin older than 5.0.0 where users hold the mod/vpl:similarity capability, typically teachers and graders who review code similarity reports. Sites without VPL installed, or running 5.0.0 or later, are not affected. The attack needs a targeted user to open a crafted link.
No product ranges from the sources yet.
mod/vpl/version.php in the Moodle code tree)mod/vpl/similarity/diff.php and confirm whether it encodes filename1 and filename2 before output (unknown from the sources beyond the description)5.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.
This page as .md · .json · in your agent: get_signal("CVE-2026-113683")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.