CVE-2025-30348

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-407

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-303497.2Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted tCVE-2025-30355.3By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the CVE-2025-303505.3Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in versiCVE-2025-303514.3Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a CVE-2025-303525.3Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5CVE-2025-303537.5Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, wheCVE-2025-303544.3Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer ModCVE-2025-303557.5Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse versioCVE-2025-303569.8CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure commCVE-2025-303576.8NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leavCVE-2025-303588.1Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version CVE-2025-303595.9webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-s