CVE-2025-30190

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-301915.4Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sens CVE-2025-301927.5An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. CVE-2025-301937.5In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client CVE-2025-301947.5When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange tha CVE-2025-301957.5An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illega CVE-2025-301966.5Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme CVE-2025-301973.1Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for att CVE-2025-301986.3ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived CVE-2025-301997.2ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insec CVE-2025-30205.4An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the config CVE-2025-302006.3ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easi CVE-2025-302019.1Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wa