SCHUTZWERK-SA-2024-006: Stored Cross-Site Scripting via text fields in H5P module (h5p-nodejs-library) of Lumi Education
Stored XSS in Lumi Education h5p-nodejs-library before 9.3.3 runs injected script in viewers' browsers.
34
Product
h5p-nodejs-library
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 22, 2026
- Last mentionedSep 27, 2026
Timeline
2 articles · newest firstSCHUTZWERK-SA-2024-007: Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
Stored XSS in Lumi Education h5p-nodejs-library through 10.0.4 lets uploaded H5P content run JavaScript.
42
Appears with
- SCHUTZWERKorganization · 2
- H5Pproduct · 2
- Lumi Educationvendor · 2
- Lumi Educationorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.