PT-2025-26659 · Moodle · Moodle Lms Jmol Plugin

Dionach Admin · Published 2025-06-24 · Updated 2025-11-19 · CVE-2025-34032

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Moodle LMS Jmol plugin versions 6.1 and prior

Description: A reflected cross-site scripting (XSS) issue exists due to the application's failure to properly sanitize user input before embedding it into the HTTP response. This allows an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link, potentially hijacking user sessions or manipulating page content. The issue is specifically related to the data parameter in jsmol.php.

Recommendations: For Moodle LMS Jmol plugin versions 6.1 and prior, consider disabling the jsmol.php endpoint or restricting access to it until a patch is available. Avoid using the data parameter in the affected jsmol.php endpoint until the issue is resolved.

Exploit

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2025-34032

Affected Products

Moodle Lms Jmol Plugin

References · 10

• 🔥 https://dionach.com/moodle-jmol-plugin-multiple-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/46881 · Exploit
• https://osv.dev/vulnerability/CVE-2025-34032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34032 · Security Note
• https://twitter.com/CVEnew/status/1937344577960136710 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1938190522142888368 · Twitter Post
• https://t.me/cvenotify/128260 · Telegram Post
• https://t.me/cveNotify/143433 · Telegram Post
• https://vulncheck.com/advisories/moodle-lms-jmol-plugin-xss · Note
• https://vulncheck.com/advisories/moodle-lms-jmol-jsmol-plugin-xss · Note