CVE-2025-30345

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.

• CWE-116
• CWE-79

• https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlidesExploit, Third Party Advisory

Published

Mar 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30330Illustrator versions 29.3, 28.7.5 and earlier are affected b…7.8
• CVE-2025-30334In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before erra…7.1
• CVE-2025-3034Memory safety bugs present in Firefox 136 and Thunderbird 13…8.1
• CVE-2025-30342An XSS issue was discovered in OpenSlides before 4.2.5. When…6.1
• CVE-2025-30343A directory traversal issue was discovered in OpenSlides bef…6.5
• CVE-2025-30344An issue was discovered in OpenSlides before 4.2.5. During l…3.7
• CVE-2025-30346Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0…4.8
• CVE-2025-30347Varnish Enterprise before 6.0.13r13 allows remote attackers …7.5
• CVE-2025-30348encodeText in QDom in Qt before 6.8.0 has a complex algorith…5.3
• CVE-2025-30349Horde IMP through 6.2.27, as used with Horde Application Fra…7.2
• CVE-2025-3035By first using the AI chatbot in one tab and later activatin…5.3
• CVE-2025-30350Directus is a real-time API and App dashboard for managing S…5.3