Jcrodriguez-dis vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Jcrodriguez-dis products: 1 record(s), with severity, exploitation and fixes.

Moodle-mod Vpl 1

Exploited only (KEV) →

CVE-2026-113683 Medium · 6.1 CWE-79 Oct 20, 2026

VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.