CVE catalog
CVE-2025-30349
php-horde-imp: CVE-2025-30349
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 31.29% · Oct 25, 2026
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-horde-imp | sid | 6.2.27-3.1 | vulnerable |
| Debian | php-horde-imp | bookworm | 6.2.27-3 | vulnerable |
| Ubuntu | php-horde | 16.04 | 5.2.7+debian0-1 | vulnerable |
| Ubuntu | php-horde | 16.04 | 5.2.8+debian0-1 | vulnerable |
| Ubuntu | php-horde | 16.04 | 5.2.9+debian0-1 | vulnerable |
| Ubuntu | php-horde | 16.04 | 5.2.9+debian0-1build1 | vulnerable |
| Ubuntu | php-horde-imp | 16.04 | 6.2.10-1 | vulnerable |
| Ubuntu | php-horde-imp | 16.04 | 6.2.11-1 | vulnerable |
| Ubuntu | php-horde-imp | 16.04 | 6.2.12-1 | vulnerable |
| Ubuntu | php-horde-imp | 16.04 | 6.2.12-1ubuntu1 | vulnerable |
| Ubuntu | php-horde | 18.04 | 5.2.16+debian0-1 | vulnerable |
| Ubuntu | php-horde | 18.04 | 5.2.17+debian0-1 | vulnerable |
| Ubuntu | php-horde-imp | 18.04 | 6.2.20-1 | vulnerable |
| Ubuntu | php-horde-imp | 18.04 | 6.2.21-1 | vulnerable |
| Ubuntu | php-horde-imp | 18.04 | 6.2.21-1ubuntu1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [php-horde-imp]Affected
Details (2)
6.2.27-3· all · bookwormAffected
dsa · php-horde-imp · debian · bookworm; dsa · php-horde-imp · debian · 12
6.2.27-3· all · bookwormAffected
dsa · php-horde-imp · debian · bookworm; dsa · php-horde-imp · debian · 12
Observed: