CVE-2025-30191

MEDIUM

OX App Suite < 7.6.3-rev77, < 8.35.111, < 8.38.82, < 8.39.79, < 8.40.57 - Clickjacking via HTML Fragment Injection

Title source: llm
STIX 2.1

Description

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known

References (1)

Core 1

Scores

CVSS v3 5.4
EPSS 0.0015
EPSS Percentile 4.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1021
Status published
Products (5)
Open-Xchange GmbH/OX App Suite < 7.6.3-rev77
Open-Xchange GmbH/OX App Suite < 8.35.111
Open-Xchange GmbH/OX App Suite < 8.38.82
Open-Xchange GmbH/OX App Suite < 8.39.79
Open-Xchange GmbH/OX App Suite < 8.40.57
Published Oct 31, 2025
Tracked Since Feb 18, 2026