Description
A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Moodle | Jmol Plugin | ≤ 6.1 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting http/cves/2025/CVE-2025-34032.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.dionach.com/moodle-jmol-plugin-multiple-vulnerabilities/ exploit technical-description
- https://www.exploit-db.com/exploits/46881 third-party-advisory exploit
- https://vulncheck.com/advisories/moodle-lms-jmol-plugin-xss third-party-advisory