CVE-2025-30349

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-30355.3By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the CVE-2025-303505.3Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in versi CVE-2025-303514.3Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a CVE-2025-303525.3Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5 CVE-2025-303537.5Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, whe CVE-2025-303544.3Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mod CVE-2025-303557.5Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse versio CVE-2025-303569.8CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm CVE-2025-303576.8NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leav CVE-2025-303588.1Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version CVE-2025-303595.9webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-s CVE-2025-30366.1A vulnerability, which was classified as problematic, was found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5