CVE-2025-34032

Moodle LMS Jmol Plugin Cross-site Scripting (XSS)

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.

Affected

Moodle · Jmol Plugin

CVSS v4.0 VULNCHECK

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.78% chance of exploitation in the next 30 days, 55th percentile

Nuclei

medium · CWE-80

Published

2025-06-24

Updated

2026-05-14

Proof-of-concept exploits (2)

• https://www.dionach.com/moodle-jmol-plugin-multiple-vulnerabilities/
• https://www.exploit-db.com/exploits/46881

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34032.yaml

Security advisories

• https://vulncheck.com/advisories/moodle-lms-jmol-plugin-xss
• https://www.dionach.com/moodle-jmol-plugin-multiple-vulnerabilities

References

• CVE Record
• NVD entry