CVE-2025-7062CWE-20CWE-79cross-site-scripting

CVE-2025-7062

published September 9, 2026

CVSS
5.2
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

The record
Technical detail
CVSS
5.2 · NONE
CVSS v4.0
5.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P
EPSS
0.00300 · 21.6th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-09T11:16Z
References (3)
https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4 · 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/ · 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423http://seclists.org/fulldisclosure/2026/Sep/41 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 10 SEP 03:15Z
    EPSS moved — → 0%
    epss
  • 09 SEP 06:14Z
    Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
    cvelistv5