CVE-2025-34032: geoffrowland jmol Cross-site Scripting
Vulnerability summary
CVE-2025-34032 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in geoffrowland jmol. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.1% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 24-06-2025PublishedVulnerability first disclosed.
- 14-05-2026Last modifiedVulnerability information updated.
Description
A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.03 pp
From 0.75% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundMoodle Jmol Filter 6.1 - Directory Traversal / Cross-Site Scripting
Maturity: poc
Exploit Reference (dionach.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Geoffrowland1 product
- jmol≤ 6.1
Moodle1 product
- jmol plugin≤ 6.1
2 vendors · 2 products
References
3 links- www.dionach.com/moodle-jmol-plugin-multiple-vulnerabilities/ExploitTechnical DescriptionThird Party Advisory
- vulncheck.com/advisories/moodle-lms-jmol-plugin-xssThird Party Advisory