CVE-2025-30349

HIGH EXPLOITED

Horde IMP < 6.2.27 - Cross-Site Scripting via Crafted Email onerror Attribute

Title source: llm

Exploitation Summary

CVE-2025-30349 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including natasaka.

AI-analyzed exploit summary This PoC exploits an XSS vulnerability in Horde IMP by sending a crafted email with obfuscated HTML/JavaScript payloads. The payloads execute arbitrary JavaScript when the email is viewed in the Horde Web Client.

Description

Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.

Exploits (1)

nomisec WORKING POC

by natasaka · client-side

https://github.com/natasaka/CVE-2025-30349

View Code ZIP pw:eip

This PoC exploits an XSS vulnerability in Horde IMP by sending a crafted email with obfuscated HTML/JavaScript payloads. The payloads execute arbitrary JavaScript when the email is viewed in the Horde Web Client.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Horde 5.2.23; IMP 6.2.27

Auth required

Prerequisites: Access to an SMTP server · Valid credentials for the SMTP server · Target must view the email in Horde Web Client

MITRE ATT&CK