{"id":"CVE-2025-30349","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-30349","generatedAt":"2026-11-03T22:42:08.716Z","title":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in…","description":"Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.","published":"2025-03-21T17:15:41.000Z","lastModified":"2026-06-17T09:08:34.000Z","status":"Deferred","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.31292,"percentile":0.98276,"date":"2026-11-02","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 31.3%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://github.com/horde/base/releases/tag/v5.2.23","source":"cve@mitre.org"},{"url":"https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25","source":"cve@mitre.org"},{"url":"https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62","source":"cve@mitre.org"},{"url":"https://github.com/horde/imp/releases/tag/v6.2.27","source":"cve@mitre.org"},{"url":"https://github.com/horde/webmail/releases/tag/v5.2.22","source":"cve@mitre.org"},{"url":"https://github.com/natasaka/CVE-2025-30349/","source":"cve@mitre.org"},{"url":"https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html","source":"cve@mitre.org"},{"url":"https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html","source":"cve@mitre.org"},{"url":"https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html","source":"cve@mitre.org"},{"url":"https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html","source":"cve@mitre.org"},{"url":"https://www.horde.org/apps/horde","source":"cve@mitre.org"},{"url":"https://www.horde.org/apps/imp","source":"cve@mitre.org"},{"url":"https://www.horde.org/download/horde","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00008.html","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-30349","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}