H5P Nodejs Library
Monthly
Stored cross-site scripting in Lumi Education UG's h5p-nodejs-library (all versions prior to 10.0.4) allows an authenticated user with H5P content upload access to embed malicious JavaScript inside an H5P package, which then executes in the browsers of any subsequent users who view that content. The CVSS 4.0 vector (SC:H/SI:H) reflects that the primary damage lands on victim browsers - enabling session hijacking, credential theft, or arbitrary DOM manipulation - rather than on the server itself. No public exploit identified at time of analysis, though the CVSS 4.0 E:P supplemental metric indicates exploit code or proof-of-concept exists.
Stored cross-site scripting in Lumi Education UG's h5p-nodejs-library (all versions prior to 10.0.4) allows an authenticated user with H5P content upload access to embed malicious JavaScript inside an H5P package, which then executes in the browsers of any subsequent users who view that content. The CVSS 4.0 vector (SC:H/SI:H) reflects that the primary damage lands on victim browsers - enabling session hijacking, credential theft, or arbitrary DOM manipulation - rather than on the server itself. No public exploit identified at time of analysis, though the CVSS 4.0 E:P supplemental metric indicates exploit code or proof-of-concept exists.