CVE-2026-113683

MediumCVSS 6.1/10Last modified Oct 23, 2026

Description

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
jcrodriguez-dismoodle-mod_vpl< 5.0.0

References

Timeline

Published
Oct 20, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-113697.1The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that thCVE-2026-11378.8A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formWebAuthGlobaCVE-2026-113706.4The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_CVE-2026-1137039.3SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authenticationCVE-2026-1137047.3A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/pushCVE-2026-1137055.3A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/errorCVE-2026-1137063.5A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemCVE-2026-1137075.4A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the CVE-2026-1137089.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize pCVE-2026-1137099.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an opeCVE-2026-113716.1The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and CVE-2026-1137105.9ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the c