Home > Vulnerability Database > CVE-2025-30349

Mend.io Vulnerability Database

CVE-2025-30349

Date: March 20, 2025

Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.

Severity Score

7.2

Related Resources (17)

Url: https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-30349

Url: https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62

Url: https://www.horde.org/download/horde

Url: https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25

Url: https://github.com/horde/base/releases/tag/v5.2.23

Url: https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html

Url: https://github.com/horde/imp/releases/tag/v6.2.27

Url: https://github.com/natasaka/CVE-2025-30349/

Url: https://www.horde.org/apps/imp

Url: https://www.horde.org/apps/horde

Url: https://security-tracker.debian.org/tracker/CVE-2025-30349

Url: https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html

Url: https://github.com/horde/webmail/releases/tag/v5.2.22

Url: https://lists.debian.org/debian-lts-announce/2025/04/msg00008.html

Url: https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html

Url: https://www.mend.io/vulnerability-database/CVE-2025-30349

Severity Score

7.2

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

CVSS v3.1

Base Score:	7.2
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2025-30349

Date: March 20, 2025

Severity Score

Related Resources (17)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?