Answer in brief
CVE-2026-113683 records a Medium severity (CVSS 5.1) vulnerability in VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename. The current sources do not mark it as known exploited. The current feed maps jcrodriguez-dis/moodle-mod_vpl (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps jcrodriguez-dis/moodle-mod_vpl (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| jcrodriguez-dis/moodle-mod_vplgeneric | >=0 <5.0.0 | 5.0.0 |
Published upstream
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 20, 2026
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.
Quoted source text, attributed separately from HOL analysis.