CVE-2025-34032: Moodle LMS Jmol Plugin Cross-site Scripting (XSS)
A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34032?
CVE-2025-34032 is classified as a high severity vulnerability due to its potential for exploitation via reflected cross-site scripting.
What versions of the Moodle LMS Jmol plugin are affected by CVE-2025-34032?
CVE-2025-34032 affects Moodle LMS Jmol plugin version 6.1 and earlier.
How do I fix CVE-2025-34032?
To fix CVE-2025-34032, upgrade the Moodle LMS Jmol plugin to the latest version that addresses the reflected XSS vulnerability.
What type of vulnerability is CVE-2025-34032?
CVE-2025-34032 is a reflected cross-site scripting (XSS) vulnerability that allows execution of arbitrary scripts.
What component of Moodle is vulnerable in CVE-2025-34032?
CVE-2025-34032 specifically affects the jsmol.php file in the Moodle LMS Jmol plugin.