{"id":"CVE-2026-113683","kind":"vulnerability","aliases":["CVE-2026-113683"],"related":[],"title":"VPL for Moodle: reflected XSS in similarity diff page","description":"VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.","summary":"VPL (Virtual Programming Lab) for Moodle before 5.0.0 does not encode the filename1 and filename2 parameters in similarity/diff.php. An attacker can send a crafted diff.php link that runs script in the browser of a user with the mod/vpl:similarity capability, letting it act or read data under that user's session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["education","lms","moodle","package","vpl"],"not_affected_if":["vpl-5.0.0-or-later","vpl-not-installed"],"how_to_check":"- Check the installed VPL plugin version in Moodle under Site administration > Plugins > Activity modules > VPL (or `mod/vpl/version.php` in the Moodle code tree)\n- Look for the similarity page `mod/vpl/similarity/diff.php` and confirm whether it encodes filename1 and filename2 before output (unknown from the sources beyond the description)","fix":"- Upgrade the VPL plugin for Moodle to `5.0.0` or later\n- Until upgraded, limit who holds the mod/vpl:similarity capability (unknown from the sources whether a workaround exists)","status":"open","published_at":"2026-10-20T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:04:06+00:00","updated_at":"2026-10-25T04:04:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:04:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the VPL plugin for Moodle to `5.0.0` or later\n- Until upgraded, limit who holds the mod/vpl:similarity capability (unknown from the sources whether a workaround exists)","reach":"internet","title":"VPL for Moodle: reflected XSS in similarity diff page","impact":"medium","summary":"VPL (Virtual Programming Lab) for Moodle before 5.0.0 does not encode the filename1 and filename2 parameters in similarity/diff.php. An attacker can send a crafted diff.php link that runs script in the browser of a user with the mod/vpl:similarity capability, letting it act or read data under that user's session.","category":"package","nicknames":[],"who_cares":["moodle","vpl","lms","education"],"confidence":0.6,"needs_auth":"no","worst_case":"script runs in a grader's session, performing actions or reading data","analyst_note":"Confirm the affected version range and fixed release from the NVD entry and the VPL project's advisory; the sources give only 'before 5.0.0'.","how_to_check":"- Check the installed VPL plugin version in Moodle under Site administration > Plugins > Activity modules > VPL (or `mod/vpl/version.php` in the Moodle code tree)\n- Look for the similarity page `mod/vpl/similarity/diff.php` and confirm whether it encodes filename1 and filename2 before output (unknown from the sources beyond the description)","needs_analyst":true,"not_affected_if":["vpl-5.0.0-or-later","vpl-not-installed"],"who_is_affected":"Moodle sites running the VPL (Virtual Programming Lab) plugin older than 5.0.0 where users hold the mod/vpl:similarity capability, typically teachers and graders who review code similarity reports. Sites without VPL installed, or running 5.0.0 or later, are not affected. The attack needs a targeted user to open a crafted link.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":3370,"output_tokens":705,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113683':12A,15A '-2026':11A,14A '5.0.0':28B,79C 'act':63B 'action':122C 'allow':89C 'attack':40B,91C,101C 'browser':52B 'capabl':60B 'contain':80C 'craft':44B,103C 'cross':84C 'cross-sit':83C 'cve':10A,13A 'data':66B,125C 'diff':8A 'diff.php':45B,105C 'disclos':124C 'educ':16B 'encod':31B 'filename1':33B 'filename1/filename2':97C 'filename2':35B 'hold':116C 'inject':93C 'javascript':109C 'lab':24B,75C 'let':61B 'link':46B,106C 'lms':17B 'mod/vpl':58B,117C 'moodl':3A,18B,26B,77C 'open':119C 'packag':19B 'page':9A 'paramet':36B,98C 'payload':110C 'perform':121C 'program':23B,74C 'read':65B 'reflect':4A,82C 'remot':90C 'run':48B,112C 'script':49B,86C,94C 'send':42B 'session':71B,128C 'similar':7A,59B,118C 'similarity/diff.php':38B,100C 'site':85C 'unencod':96C 'user':55B,69B,115C 'via':95C 'virtual':22B,73C 'vpl':1A,20B,21B,72C 'vulner':87C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Moodle sites running the VPL (Virtual Programming Lab) plugin older than 5.0.0 where users hold the mod/vpl:similarity capability, typically teachers and graders who review code similarity reports. Sites without VPL installed, or running 5.0.0 or later, are not affected. The attack needs a targeted user to open a crafted link.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113683","severity":null,"published_at":"2026-10-20T16:17:13+00:00","modified_at":"2026-10-23T02:16:56+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}