CVE-2025-7062

5.2 Moyenne

Publiée le 09/09/2026 à 09:16 · Modifiée le 20/10/2026 à 00:10 · Analyse NVD reportée · Source : 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423

Description

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Traduire en français

Produits concernés

Lumi Education UG h5p-nodejs-library

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.2 Moyenne	23637b5d-af4c-4cf9-b8f6-deb7fd0f8423	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-20
CWE-79

Références

https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4
https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/
http://seclists.org/fulldisclosure/2026/Sep/41

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories