Is CVE-2026-113683 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-113683?

CVE-2026-113683 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-113683

Description

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.