CVE-2025-34032

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.

CVSS v4.0

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.68% chance of exploitation in the next 30 days, 50th percentile

Nuclei

medium · CWE-80

Published

2025-06-24

Updated

2026-05-14

Proof-of-concept exploits (2)

• https://www.dionach.com/moodle-jmol-plugin-multiple-vulnerabilities/
• https://www.exploit-db.com/exploits/46881

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34032.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-34031
• CVE-2025-34033
• CVE-2025-34030
• CVE-2025-34034
• CVE-2025-3403
• CVE-2025-34035