CVE-2025-30190 — Cross-site Scripting in Gmbh OX APP Suite

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.1%
top 83.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Open-xchange Gmbh OX APP Suite
Timeline
PublishedNov 27

Description

Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages1 packages

▶CVEListV5open-xchange_gmbh/ox_app_suite8.35.1513817+3

🔴Vulnerability Details

2
CVEList
CVE-2025-30190: Malicious content at office documents can be used to inject script code when editing a document↗2025-11-27
▶
GHSA
GHSA-q975-g9wv-44h5: Malicious content at office documents can be used to inject script code when editing a document↗2025-11-27
▶
CVE-2025-30190 — Cross-site Scripting | cvebase