VULNpocalypse

CVE-2026-113683: VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-10-20).

Weakness: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and a user must actively take an action. Impact: confidentiality none, integrity none, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-105099, GHSA-2929-5xr7-ghmp

VEDAS cluster: VEDAS:DOOMBEACON

Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (5)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (3)

Catalogue entries, not exploit evidence.

2 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS
0.004
low predicted chance of attack
VEDAS
0.989
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

Who is affected

ProductAffectedNot affected
jcrodriguez-dis moodle-mod_vplbefore 5.0.0Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 5.0.0.

Vendor guidance:

How to detect it

Nuclei template (active check)

Moodle VPL - Cross-Site Scripting

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability in similarity/diff.php. The similarity comparison reads the filename1 and filename2 request parameters with required_param(..., PARAM_RAW) and appends their values directly into the page’s HTML header without HTML-encoding, so an attacker who lures a user holding the mod/vpl:similarity capability to a crafted diff.php link can run arbitrary JavaScript in that user’s authenticated session.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /mod/vpl/similarity/diff.php?id=1&filename1=%22%3E%3Cimg%20src%3Dx%...); it decides using status, word matchers. Severity in the template: medium. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash
nuclei -u https://your-host -t CVE-2026-113683.yaml
Show the template (44 lines)
yaml
id: CVE-2026-113683

info:
  name: "Moodle VPL - Cross-Site Scripting"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site
    scripting vulnerability in similarity/diff.php. The similarity comparison reads the
    filename1 and filename2 request parameters with required_param(..., PARAM_RAW) and appends
    their values directly into the page's HTML header without HTML-encoding, so an attacker who
    lures a user holding the mod/vpl:similarity capability to a crafted diff.php link can run
    arbitrary JavaScript in that user's authenticated session.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-113683&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=moodle&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2026-113683
    cwe-id: CWE-79
  metadata:
    verified: false
  tags: cve,cve2026,moodle,vpl,xss
http:
  - method: GET
    path:
      - "{{BaseURL}}/mod/vpl/similarity/diff.php?id=1&filename1=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(vedasxss113683)%3E&filename2=b"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"><img src=x onerror=alert(vedasxss113683)>'

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200

CVE-2026-113683.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-113683 Moodle VPL - Cross-Site Scripting Attempt. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-113683 Moodle VPL - Cross-Site Scripting Attempt"; flow:established,to_server; http.uri; content:"/mod/vpl/similarity/diff.php"; nocase; fast_pattern; content:"filename1="; nocase; content:"<"; distance:0; classtype:web-application-attack; reference:cve,CVE-2026-113683; reference:url,https://www.exploit.observer/?keyword=CVE-2026-113683&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=moodle&match=exact; sid:1078603; rev:1;)

CVE-2026-113683.rules on GitHub

References

Vendor advisories and patches

Exploits and technical analysis

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.