{"metadata": {"vulnerability": "cve-2025-30349", "count": 31, "kinds": {"milestone": 5, "sighting": 11, "kev": 5, "other": 10}}, "data": [{"timestamp": "2025-03-21T00:00:00Z", "date_only": false, "value": "2025-03-21T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-30349", "field": "timestamps.asserted_at", "uuid": "14c06f14-50e9-47c9-9cf8-a9e70a647913", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-03-21T00:00:00Z", "date_only": false, "value": "2025-03-21T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-30349", "field": "evidence.0.details.added_date", "uuid": "14c06f14-50e9-47c9-9cf8-a9e70a647913", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-03-21T00:00:00Z", "date_only": false, "value": "2025-03-21T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-30349", "field": "timestamps.first_seen_at", "uuid": "14c06f14-50e9-47c9-9cf8-a9e70a647913", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-03-21T00:00:00Z", "date_only": false, "value": "2025-03-21T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-30349", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-03-21T00:00:00Z", "date_only": false, "value": "2025-03-21T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-30349", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-21T00:00:00Z", "date_only": false, "value": "2025-03-21T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-30349", "field": "status.status_updated_at", "uuid": "14c06f14-50e9-47c9-9cf8-a9e70a647913", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-03-21T17:15:00Z", "date_only": false, "value": "2025-03-21T17:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2025-30349", "record": "UBUNTU-CVE-2025-30349", "field": "published"}, {"timestamp": "2025-03-21T17:15:40Z", "date_only": false, "value": "2025-03-21T17:15:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MCHQ-VV84-M9GR", "record": "GHSA-MCHQ-VV84-M9GR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-03-21T17:15:40.853Z", "date_only": false, "value": "2025-03-21T17:15:40.853", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-30349", "record": "FKIE_CVE-2025-30349", "field": "published"}, {"timestamp": "2025-03-21T17:19:13Z", "date_only": false, "value": "2025-03-21T17:19:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/DarkWebInformer_CVEAlerts/8376", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "60371c18-9b3d-494d-9fb8-dd53c0e296b0", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30349\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T16:46:44.367Z\n\ud83d\udd17 References:\n1. https://github.com/horde/webmail/releases/tag/v5.2.22\n2. https://www.horde.org/apps/imp\n3. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n4. https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n5. https://www.horde.org/download/horde\n6. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62\n7. https://www.horde.org/apps/horde\n8. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25\n9. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html\n10. https://github.com/horde/imp/releases/tag/v6.2.27\n11. https://github.com/horde/base/releases/tag/v5.2.23\n12. https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html", "url": "https://t.me/DarkWebInformer_CVEAlerts/8376"}, {"timestamp": "2025-03-21T18:31:35Z", "date_only": false, "value": "2025-03-21T18:31:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MCHQ-VV84-M9GR", "record": "GHSA-MCHQ-VV84-M9GR", "field": "published"}, {"timestamp": "2025-03-21T20:09:28Z", "date_only": false, "value": "2025-03-21T20:09:28.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cvedetector/20828", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "65cc254d-2f84-4c09-beb5-c0c30527b7b9", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30349 - Horde IMP Cross-Site Scripting (XSS) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-30349 \nPublished : March 21, 2025, 5:15 p.m. | 1\u00a0hour, 31\u00a0minutes ago \nDescription : Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025. \nSeverity: 7.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/20828"}, {"timestamp": "2025-03-22T21:01:54.796Z", "date_only": false, "value": "2025-03-22T21:01:54.796193Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lkymr5yh3g2f", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "398042fd-76c3-4112-bd8c-6f51f7de0dd0", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lkymr5yh3g2f"}, {"timestamp": "2025-03-28T00:00:06Z", "date_only": false, "value": "2025-03-28T00:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/IpSkdng-DvuBirFh-8nYsY3OgxKRFd_quSrS72XmwTlTwLs", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "da29dafe-603a-42c6-a673-3d57390c7b81"}, {"timestamp": "2025-03-28T00:01:10.320Z", "date_only": false, "value": "2025-03-28T00:01:10.320Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2025-30349", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-28T00:35:31Z", "date_only": false, "value": "2025-03-28T00:35:31.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/DarkWebInformer_CVEAlerts/9244", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "2be8868e-c46e-4c28-8a80-ce6e01635849", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30349\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-28T00:01:10.320Z\n\ud83d\udd17 References:\n1. https://github.com/horde/webmail/releases/tag/v5.2.22\n2. https://www.horde.org/apps/imp\n3. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n4. https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n5. https://www.horde.org/download/horde\n6. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62\n7. https://www.horde.org/apps/horde\n8. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25\n9. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html\n10. https://github.com/horde/imp/releases/tag/v6.2.27\n11. https://github.com/horde/base/releases/tag/v5.2.23\n12. https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html\n13. https://github.com/natasaka/CVE-2025-30349/", "url": "https://t.me/DarkWebInformer_CVEAlerts/9244"}, {"timestamp": "2025-03-28T04:00:06Z", "date_only": false, "value": "2025-03-28T04:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/-_T7fiB1UH9VRuMWqeF5wAirAQ9WEH4yGxP0ggrYXPxHLtk", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "2589e6e0-83a8-468f-accf-04ca125648e1"}, {"timestamp": "2025-04-03T12:04:26.080Z", "date_only": false, "value": "2025-04-03T12:04:26.080Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2025-30349", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-03T12:30:24Z", "date_only": false, "value": "2025-04-03T12:30:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MCHQ-VV84-M9GR", "record": "GHSA-MCHQ-VV84-M9GR", "field": "modified"}, {"timestamp": "2025-04-03T19:57:19.164Z", "date_only": false, "value": "2025-04-03T19:57:19.164722Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-30349", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-04-03T19:57:19.164Z", "date_only": false, "value": "2025-04-03T19:57:19.164722Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-30349", "record": "FKIE_CVE-2025-30349", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-04-03T19:57:27.039Z", "date_only": false, "value": "2025-04-03T19:57:27.039Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-30349", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-04-03T19:57:27.039Z", "date_only": false, "value": "2025-04-03T19:57:27.039Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-30349", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-24T05:18:10Z", "date_only": false, "value": "2025-10-24T05:18:10Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2025-30349", "record": "UBUNTU-CVE-2025-30349", "field": "modified"}, {"timestamp": "2026-06-17T09:08:33.550Z", "date_only": false, "value": "2026-06-17T09:08:33.550", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-30349", "record": "FKIE_CVE-2025-30349", "field": "lastModified"}, {"timestamp": "2026-06-19T12:46:23.865Z", "date_only": false, "value": "2026-06-19T12:46:23.865163Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52c9cb05-6ad2-4e91-abe2-d77c6f8d180a", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "09fb2bf5-3bab-4039-a7c3-0a11f8a2ee66", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52c9cb05-6ad2-4e91-abe2-d77c6f8d180a"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-30349", "field": "timestamps.recorded_at", "uuid": "14c06f14-50e9-47c9-9cf8-a9e70a647913", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:12:53.983Z", "date_only": false, "value": "2026-06-23T11:12:53.983716Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/14c06f14-50e9-47c9-9cf8-a9e70a647913", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "ad02af18-9739-4c59-ab1c-724e4a2dc6e8", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/14c06f14-50e9-47c9-9cf8-a9e70a647913"}, {"timestamp": "2026-06-23T14:04:04.574Z", "date_only": false, "value": "2026-06-23T14:04:04.574992Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f3dfea3f-6bd7-48cd-8fde-a2cc6b595ff7", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "288e83d6-bfca-4273-ae27-d8ea7698f876", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f3dfea3f-6bd7-48cd-8fde-a2cc6b595ff7"}, {"timestamp": "2026-07-26T02:00:12.226Z", "date_only": false, "value": "2026-07-26T02:00:12.226573Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/834", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "fa8ba62e-3540-47a5-8f11-35ed781d90c7", "url": "https://t.me/cyberwarehouse/834"}, {"timestamp": "2026-07-27T00:00:30.352Z", "date_only": false, "value": "2026-07-27T00:00:30.352826Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/834", "record": "CVE-2025-30349", "field": "creation_timestamp", "uuid": "fa53fa73-4b96-4e63-afcf-64acb58a8143", "url": "https://t.me/cyberwarehouse/834"}]}