CVE-2025-30090 HIGH

CVE-2025-30090

Vendor Squirrelmail

Product SquirrelMail

Weakness CWE-79 · XSS

Published April 2, 2025

Last update April 2, 2025

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.

Key dates

02Disclosure timeline

April 2, 2025 CVE published

April 2, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-30090 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

Identifiers

CVE CVE-2025-30090

CWE CWE-79

CVSS 7.2 / HIGH

Affected versions

Vendor Squirrelmail

Product SquirrelMail

Affected ≤ 1.4.23-svn-20250401

Vendor Squirrelmail

Product SquirrelMail

Affected ≥ 1.5 and ≤ 1.5.2-svn-20250401

CVE-2025-30090

01Description

02Disclosure timeline

03References

04Related CVE