CVE-2025-7062

Severity CVSS v4.0:

MEDIUM

Type:

CWE-20 Input Validation

Publication date:

09/09/2026

Last modified:

22/09/2026

Description

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

Impact

Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P CVSS v4.0 Severity and Metrics:

Base Score: 5.20 MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): None
Privileges Required (PR): Low
User Interaction (UI): Active
Confidentiality (VC): None
Integrity (VI): None
Availability (VA): None
Confidentiality (SC): High
Integrity (SI): High
Availability (SA): Low
Exploit Maturity (E): POC

Base Score 4.0

5.20

Severity 4.0

MEDIUM

CVE-2025-7062

Description

Impact

References to Advisories, Solutions, and Tools