jcrodriguez-dis CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM jcrodriguez-dis CVE published 2026-10-20

CVE-2026-113683

A reflected cross-site scripting vulnerability exists in VPL (Virtual Programming Lab) for Moodle before version 5.0.0. This vulnerability allows remote attackers to inject malicious scripts via unencoded filename parameters in the similarity/diff.php file. An attacker can craft a malicious link with a JavaScript payload that executes when a user with mod/vpl:similarity permissions opens it, potentially l [truncated]