Read the docs
TI-2025-24201 Aliases CVE-2025-34032GHSA-pj56-mpf8-xh3c

Moodle LMS Jmol Plugin Cross-site Scripting (XSS)

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0078 56th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MoodleJmol Pluginup to 6.1—No fix listedCNA
  • Jmol Plugin VendorMoodle Affected up to 6.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:geoffrowland:jmol:*:*:*:*:*:moodle:*:*up to 6.1VulnerableGeoffrowland
  • cpe:2.3:a:geoffrowland:jmol:*:*:*:*:*:moodle:*:* Versions up to 6.1 Vulnerable ·Geoffrowland

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34032
  2. 2026-10-03 Alias added: GHSA-pj56-mpf8-xh3c

References

Exploit 2

  • TI-2024-22468 moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php CVSS 3.1CRITICAL 9.8
  • TI-2021-14741 In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. CVSS 3.1CRITICAL 9.8
  • TI-2024-29071 Moodle: remote code execution via calculated question types CVSS 3.1HIGH 8.1
  • TI-2025-24200 Moodle LMS Jmol Plugin Path Traversal CVSS 4.0HIGH 8.7
  • TI-2016-06653 Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified… CVSS 3.1HIGH 7.5
  • TI-2022-00259 SQL injection in moodle CVSS 3.1CRITICAL 9.8
See all 644 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences