CVE-2026-113683: VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this attack?
Users who hold the mod/vpl:similarity capability are exposed if they open an attacker-crafted similarity/diff.php link. The injected script executes in the context of that user's Moodle session.
What does an attacker need to exploit the issue?
The attacker needs to craft a link to similarity/diff.php containing a JavaScript payload in the filename1 or filename2 parameter and persuade a user with mod/vpl:similarity to open it. No attacker authentication is specified.
Are installations running VPL 5.0.0 affected?
No. The issue affects VPL versions before 5.0.0.