moodle Vulnerabilities and Affected Products
Vulnerabilities associated with LMS Jmol Plugin.
Products
Clear product- moodle55 vulnerabilities
- h5p2 vulnerabilities
- Jmol Plugin2 vulnerabilities
- LMS Jmol Plugin2 vulnerabilities
- LMS1 vulnerability
- Moodle LMS1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-34032MEDIUM | Moodle LMS Jmol Plugin Cross-site Scripting (XSS)A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-… | CVSS5.1v4.0 | EPSS0.626% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-34031HIGH | Moodle LMS Jmol Plugin Path TraversalA path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbitrary files from the server's filesystem by crafting a malicious query value. This vulnerability can be exploited without authentication and may expose sensitive configuration data, including database credentials. Exploitation evidence was … | CVSS8.7v4.0 | EPSS2.86% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |