CVE-2025-30342

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly encoded when reflected; however, adding attributes to links is possible, which allows the injection of JavaScript via the onmouseover attribute and others. When a user moves the mouse over such a prepared link, JavaScript is executed in that user's session.

• CWE-79
• CWE-79

• https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlidesExploit, Third Party Advisory

Published

Mar 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30328Animate versions 24.0.8, 23.0.11 and earlier are affected by…7.8
• CVE-2025-30329Animate versions 24.0.8, 23.0.11 and earlier are affected by…5.5
• CVE-2025-3033After selecting a malicious Windows `.url` shortcut from the…7.7
• CVE-2025-30330Illustrator versions 29.3, 28.7.5 and earlier are affected b…7.8
• CVE-2025-30334In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before erra…7.1
• CVE-2025-3034Memory safety bugs present in Firefox 136 and Thunderbird 13…8.1
• CVE-2025-30343A directory traversal issue was discovered in OpenSlides bef…6.5
• CVE-2025-30344An issue was discovered in OpenSlides before 4.2.5. During l…3.7
• CVE-2025-30345An issue was discovered in OpenSlides before 4.2.5. When cre…4.1
• CVE-2025-30346Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0…4.8
• CVE-2025-30347Varnish Enterprise before 6.0.13r13 allows remote attackers …7.5
• CVE-2025-30348encodeText in QDom in Qt before 6.8.0 has a complex algorith…5.3