CVE-2025-30349
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e...
Original description
The description as published by the source.
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-30349 php-horde-imp Fixed in: 6.2.27-2+deb11u1
References
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web lists.debian.org
- web lists.horde.org
- web lists.horde.org
- web web.archive.org
- web web.archive.org
- web horde.org
- web horde.org
- web horde.org