Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
Conclusion & alert: CVE-2025-30349 is rated High Risk (65.1/100): CVSS High severity, with high exploitation likelihood (EPSS 40.31%, 97th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +2.19% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-04-30 | 38.12% | 40.31% | +2.19% |
| 2 | 2026-04-29 | 18.61% | 38.12% | +19.51% |
| 3 | 2026-01-15 | — | 18.61% | — |
Full EPSS history (23 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.2 | 3.1 | HIGH |
|
3.9 | 2.7 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2025-30349 not yet assigned priority: Debian including 1 source packages (php-horde-imp), 3 status rows across 3 suites (bookworm, bullseye, sid): open 2, resolved 1. | https://security-tracker.debian.org/tracker/CVE-2025-30349 |
ubuntu
|
medium | CVE-2025-30349 medium priority: Ubuntu including 2 source packages (php-horde, php-horde-imp), 18 status rows across 9 suites (bionic, focal, jammy, noble, oracular, plucky, questing, upstream, xenial): DNE 12, needs-triage 6. | https://ubuntu.com/security/CVE-2025-30349 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||