CVE-2026-113683

Deferred Deferred - Pending Action

Reflected XSS in VPL for Moodle

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113683

EUVD

EUVD-2026-105099

Affected Vendors & Products

Vendor	Product	Version / Range
jcrodriguez-dis	moodle-mod_vpl	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in VPL (Virtual Programming Lab) for Moodle before version 5.0.0. Attackers can inject malicious scripts via unencoded filename1 and filename2 parameters in the similarity/diff.php file. When a user with the mod/vpl:similarity capability opens a crafted link, the injected JavaScript executes, potentially stealing session data or performing unauthorized actions.

Detection Guidance

Check Moodle VPL versions before 5.0.0 for the reflected XSS in similarity/diff.php. Look for unencoded filename1/filename2 parameters in URLs. Inspect diff.php file for direct filename inclusion without sanitization. Monitor network traffic for suspicious links targeting mod/vpl:similarity users.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal session cookies, perform actions on behalf of the user, or access sensitive data within the user's session. Users with the mod/vpl:similarity capability are particularly at risk as they can be tricked into opening a malicious link.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. Organizations using vulnerable versions of VPL may face legal and regulatory penalties due to potential data breaches.

Mitigation Strategies

Upgrade VPL to version 5.0.0 or later immediately. Apply the sanitization fix by replacing $filename with s($filename) in diff.class.php. Restrict access to similarity/diff.php until patched. Monitor for exploitation attempts via unencoded parameters.

Hi! I’m here to help you understand CVE-2026-113683. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...