CVE-2025-30191

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known

• CWE-1021

• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2025/oxas-adv-2025-0002.json

Published

Oct 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30186Malicious content uploaded as file can be used to execute sc…5.4
• CVE-2025-30187In some circumstances, when DNSdist is configured to use the…3.7
• CVE-2025-30188Malicious or unintentional API requests can be used to add s…7.5
• CVE-2025-30189When cache is enabled, some passdb/userdb drivers incorrectl…7.4
• CVE-2025-3019KNIME Business Hub is affected by several cross-site scripti…7.2
• CVE-2025-30190Malicious content at office documents can be used to inject …5.4
• CVE-2025-30192An attacker spoofing answers to ECS enabled requests sent ou…7.5
• CVE-2025-30193In some circumstances, when DNSdist is configured to allow a…7.5
• CVE-2025-30194When DNSdist is configured to provide DoH via the nghttp2 pr…7.5
• CVE-2025-30195An attacker can publish a zone containing specific Resource …7.5
• CVE-2025-30196Jenkins AnchorChain Plugin 1.0 does not limit URL schemes fo…6.5
• CVE-2025-30197Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlie…3.1