Moodle Mod Vpl
Monthly
Reflected cross-site scripting in the VPL (Virtual Programming Lab) activity module for Moodle before 5.0.0 lets an attacker execute arbitrary JavaScript inside the browser session of a teacher or grader who holds the mod/vpl:similarity capability. The payload is delivered through the unencoded filename1/filename2 parameters of similarity/diff.php, which the plugin concatenates into the page's HTML header without escaping, so the script runs when the privileged user opens a crafted link. Because exploitation requires that user interaction and confines impact to the victim's own session rather than the Moodle server, severity is moderate (CVSS 5.1); no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully resolved in the 5.0.0 release.
Reflected cross-site scripting in the VPL (Virtual Programming Lab) activity module for Moodle before 5.0.0 lets an attacker execute arbitrary JavaScript inside the browser session of a teacher or grader who holds the mod/vpl:similarity capability. The payload is delivered through the unencoded filename1/filename2 parameters of similarity/diff.php, which the plugin concatenates into the page's HTML header without escaping, so the script runs when the privileged user opens a crafted link. Because exploitation requires that user interaction and confines impact to the victim's own session rather than the Moodle server, severity is moderate (CVSS 5.1); no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully resolved in the 5.0.0 release.