CVE-2025-30345

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-116 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-303464.8Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.CVE-2025-303477.5Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on CVE-2025-303485.3encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with re CVE-2025-303497.2Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted t CVE-2025-30355.3By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the CVE-2025-303505.3Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in versi CVE-2025-303514.3Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a CVE-2025-303525.3Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5 CVE-2025-303537.5Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, whe CVE-2025-303544.3Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mod CVE-2025-303557.5Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse versio CVE-2025-303569.8CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm