CVE-2025-34032CWE-79

Moodle LMS Jmol Plugin Cross-site Scripting (XSS)

Medium · published June 24, 2025

CVSS v4.0
5.1
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00780 · 55.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-24T00:59Z
EPSS history
Timeline
  • 24 JUN 00:59Z
    Moodle LMS Jmol Plugin Cross-site Scripting (XSS)
    cvelistv5