CVE-2025-30223

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-302245.1MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary fiCVE-2025-302255.3Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in versiCVE-2025-302327.8A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.CVE-2025-302348.3SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a DebCVE-2025-302353.5Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication atteCVE-2025-302368.6Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) CVE-2025-302378.7The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforcedCVE-2025-302388.6In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privilCVE-2025-302398.5In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data mayCVE-2025-302405.1The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted syCVE-2025-302418.6Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passingCVE-2025-302479.3An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remot