CVE-2026-113683
Medium
Description
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.
SeverityMedium
CVSS6.1
Exploit probability—
ProductJcrodriguez-dis Moodle-mod Vpl
PublishedOct 20, 2026
First seenOct 20, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- jcrodriguez-dis moodle-mod_vpl5.0.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jcrodriguez-dis moodle-mod_vpl | v < 5.0.0 | 5.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.