EUVD-2023-2842

Malicious code in bioql PyPI...

EUVD-2024-40278

Malicious code in bioql PyPI...

EUVD-2025-14282

Malicious code in bioql PyPI...

EUVD-2024-0619

Malicious code in bioql PyPI...

EUVD-2022-0480

Malicious code in bioql PyPI...

EUVD-2022-7001

Malicious code in bioql PyPI...

EUVD-2024-37394

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2024-43439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross- site scripting XSS risk. CVE-2024-43439 Note that...

Linux Distros Unpatched Vulnerability : CVE-2023-5545

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - H5P metadata automatically populated the author with the user's username, which could be sensitive information. CVE-2023-5545 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2022-2986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. CVE-2022-2986 Note that Nessus relies on the presence...

Linux Distros Unpatched Vulnerability : CVE-2022-40316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users i...

Linux Distros Unpatched Vulnerability : CVE-2022-0332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attemp...

CVE-2025-47828

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...

GHSA-M7GM-V253-56HH @lumieducation/h5p-server Fails to Sanitize Plain Text Strings

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...

@lumieducation/h5p-server Fails to Sanitize Plain Text Strings

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...

CVE-2025-47828

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...

CVE-2025-47828

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...

H5P-Nodejs-library security vulnerabilities

H5P-Nodejs-library is a collection of server-side and client-side packages open-sourced by Lumi that can be used to use h5p in nodejs backends. A security vulnerability exists in H5P-Nodejs-library versions prior to 9.3.3, which stems from not calling sanitizeHtml on a plain text string...

CVE-2025-47828: Improper Neutralization of Input During Web Page Generation

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...

CVE-2025-47828

CVE-2025-47828 affects Lumi H5P-Nodejs-library before 9.3.3. The root cause is omission of sanitizeHtml for plain text strings, enabling potential Cross-Site Scripting (XSS) risks. Impact is limited to confidentiality and integrity with no reported availability impact; attack vector is network, w...