CVE-2025-30349
CVSS 3.1 Score 7.2 of 10 (high)
Details
Summary
CVE-2025-30349 is a newly disclosed vulnerability affecting Horde IMP version 6.2.27 and Horde Application Framework version 5.2.23. This issue allows cross-site scripting (XSS) attacks, which can result in account takeover. Attackers can craft a text/html e-mail message containing base64-encoded JavaScript code and use the onerror attribute to execute the code in a user's browser. In March 2025, this vulnerability was exploited in the wild. Users are advised to update their Horde IMP and Application Framework installations as soon as possible to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Horde IMP
Affected Vendors
- Horde, LLC