{"vulnerability": "CVE-2025-3034", "sightings": [{"uuid": "e2e3f535-0926-4bb5-99a6-aebfb5719204", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30348", "type": "seen", "source": "MISP/dc77f8f5-b460-4017-98e2-9951d6fb7c60", "content": "", "creation_timestamp": "2025-03-26T14:06:50.000000Z"}, {"uuid": "398042fd-76c3-4112-bd8c-6f51f7de0dd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30349", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lkymr5yh3g2f", "content": "", "creation_timestamp": "2025-03-22T21:01:54.796193Z"}, {"uuid": "ed71a1aa-d07c-46f4-8e3f-214d7d64243b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30343", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkuuyosqw526", "content": "", "creation_timestamp": "2025-03-21T09:18:38.963095Z"}, {"uuid": "1c0d4e30-06ba-4695-8df4-10e0292753b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30342", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkuuyoftvt2x", "content": "", "creation_timestamp": "2025-03-21T09:18:37.785070Z"}, {"uuid": "6c0feb39-09ba-4c70-a0be-2ca6d6f323bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30345", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkuuyoznnw2w", "content": "", "creation_timestamp": "2025-03-21T09:18:40.141284Z"}, {"uuid": "4f244b6a-6f98-4279-8cdf-ce396e14f52f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30344", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkuuyopdfg2j", "content": "", "creation_timestamp": "2025-03-21T09:18:38.343007Z"}, {"uuid": "825cd81d-1cdd-41da-9600-3e345006abcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30348", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkv3yejily24", "content": "", "creation_timestamp": "2025-03-21T11:23:43.389694Z"}, {"uuid": "b00c7a32-d59b-4bb7-8732-2a52838a5bba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30347", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkv3yezwc52l", "content": "", "creation_timestamp": "2025-03-21T11:23:45.191835Z"}, {"uuid": "18ca0014-3f9d-43f6-a462-f49b63a65ca2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30346", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkv3yffyyj2j", "content": "", "creation_timestamp": "2025-03-21T11:23:46.985206Z"}, {"uuid": "34c245bb-a466-483e-b2fb-b4c9031e9702", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30348", "type": "seen", "source": "https://gist.github.com/EbonJaeger/2e37bf5094e25fcb1bdc946e1bf413f3", "content": "", "creation_timestamp": "2025-04-11T17:39:32.000000Z"}, {"uuid": "8ccfbbad-be5c-49d2-ac79-8ca5d6bcce5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3034", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114262832435614839", "content": "", "creation_timestamp": "2025-04-01T13:00:58.965634Z"}, {"uuid": "b1d9b617-eec5-4715-a1a2-90d5d3cff885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30346", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3lm3wpnrl4p2g", "content": "", "creation_timestamp": "2025-04-05T22:03:22.188212Z"}, {"uuid": "0449f5cf-07d1-4c98-90c5-d166d53170ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30347", "type": "seen", "source": "MISP/3e4b778d-5810-4171-a915-f1d106684af4", "content": "", "creation_timestamp": "2025-08-11T18:27:49.000000Z"}, {"uuid": "848a66c9-223e-4560-8472-d97cbcef406c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30346", "type": "seen", "source": "https://gist.github.com/benjibjmm/073740dc8e42cc97aa901766f7d65aab", "content": "", "creation_timestamp": "2025-04-27T22:15:12.000000Z"}, {"uuid": "68127229-05d8-4cae-a7b6-5c2eb4d6457c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30346", "type": "seen", "source": "MISP/3e4b778d-5810-4171-a915-f1d106684af4", "content": "", "creation_timestamp": "2025-08-11T18:27:49.000000Z"}, {"uuid": "dc989d30-71e5-40ad-a018-dd1622177af8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30346", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/8323", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30346\n\ud83d\udd25 CVSS Score: 5.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T06:36:41.957Z\n\ud83d\udd17 References:\n1. https://varnish-cache.org/security/VSV00015.html", "creation_timestamp": "2025-03-21T07:19:50.000000Z"}, {"uuid": "0fd26c7e-bc22-4bdd-8f9d-c4237297520c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3034", "type": "seen", "source": "Telegram/zhEuVcxahydHqS41CycExp24MVFwtDnEqI06aNRbe3auxBs", "content": "", "creation_timestamp": "2026-04-13T17:54:56.000000Z"}, {"uuid": "60371c18-9b3d-494d-9fb8-dd53c0e296b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30349", "type": "exploited", "source": "https://t.me/DarkWebInformer_CVEAlerts/8376", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30349\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T16:46:44.367Z\n\ud83d\udd17 References:\n1. https://github.com/horde/webmail/releases/tag/v5.2.22\n2. https://www.horde.org/apps/imp\n3. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n4. https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n5. https://www.horde.org/download/horde\n6. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62\n7. https://www.horde.org/apps/horde\n8. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25\n9. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html\n10. https://github.com/horde/imp/releases/tag/v6.2.27\n11. https://github.com/horde/base/releases/tag/v5.2.23\n12. https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html", "creation_timestamp": "2025-03-21T17:19:13.000000Z"}, {"uuid": "77999f48-f79a-402c-afaf-11a69c942152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30345", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8315", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30345\n\ud83d\udd25 CVSS Score: 3.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)\n\ud83d\udd39 Description: An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T06:03:46.827Z\n\ud83d\udd17 References:\n1. https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides", "creation_timestamp": "2025-03-21T06:21:41.000000Z"}, {"uuid": "55a84392-b151-4e02-a653-b5999a95b5f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30348", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/8321", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30348\n\ud83d\udd25 CVSS Score: 5.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L)\n\ud83d\udd39 Description: encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T06:54:16.026Z\n\ud83d\udd17 References:\n1. https://codereview.qt-project.org/c/qt/qtbase/+/581442", "creation_timestamp": "2025-03-21T07:19:48.000000Z"}, {"uuid": "2be8868e-c46e-4c28-8a80-ce6e01635849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30349", "type": "exploited", "source": "https://t.me/DarkWebInformer_CVEAlerts/9244", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30349\n\ud83d\udd25 CVSS Score: 7.2 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-28T00:01:10.320Z\n\ud83d\udd17 References:\n1. https://github.com/horde/webmail/releases/tag/v5.2.22\n2. https://www.horde.org/apps/imp\n3. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n4. https://web.archive.org/web/20250321152616/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057781.html\n5. https://www.horde.org/download/horde\n6. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62\n7. https://www.horde.org/apps/horde\n8. https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25\n9. https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html\n10. https://github.com/horde/imp/releases/tag/v6.2.27\n11. https://github.com/horde/base/releases/tag/v5.2.23\n12. https://web.archive.org/web/20250321162434/https://lists.horde.org/archives/imp/Week-of-Mon-20250317/057784.html\n13. https://github.com/natasaka/CVE-2025-30349/", "creation_timestamp": "2025-03-28T00:35:31.000000Z"}, {"uuid": "8f681e1a-215d-4688-8ce3-bb18c28982b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30347", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/8326", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30347\n\ud83d\udd25 CVSS Score: 4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N)\n\ud83d\udd39 Description: Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T06:29:15.868Z\n\ud83d\udd17 References:\n1. https://docs.varnish-software.com/security/VEV00001/", "creation_timestamp": "2025-03-21T07:19:56.000000Z"}, {"uuid": "3ee51257-dc04-460f-9cb4-cad407ee3f4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30342", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8319", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30342\n\ud83d\udd25 CVSS Score: 5.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly encoded when reflected; however, adding attributes to links is possible, which allows the injection of JavaScript via the onmouseover attribute and others. When a user moves the mouse over such a prepared link, JavaScript is executed in that user's session.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T05:52:13.561Z\n\ud83d\udd17 References:\n1. https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides", "creation_timestamp": "2025-03-21T06:21:44.000000Z"}, {"uuid": "704e1fdb-4e16-48f7-bc6a-e4efaca4b49f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30343", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8318", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30343\n\ud83d\udd25 CVSS Score: 3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N)\n\ud83d\udd39 Description: A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file or folder as a relative or absolute path (e.g., ../../../etc/passwd), the ZIP archive generated for download converts that title into a path. Depending on the extraction tool used by the user, this might overwrite files locally outside of the chosen directory.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T05:55:56.515Z\n\ud83d\udd17 References:\n1. https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides", "creation_timestamp": "2025-03-21T06:21:43.000000Z"}, {"uuid": "f42a5a2d-e0b6-4979-ae45-ca2d125c492f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30344", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8317", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30344\n\ud83d\udd25 CVSS Score: 5.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\ud83d\udd39 Description: An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password (e.g., more than 100 milliseconds).\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-21T05:57:51.082Z\n\ud83d\udd17 References:\n1. https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides", "creation_timestamp": "2025-03-21T06:21:42.000000Z"}, {"uuid": "2a29228b-2905-4b76-88ae-6c99f2613c6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-3034", "type": "seen", "source": "https://t.me/itsec_news/5712", "content": "\u200b\u26a1\ufe0fGoogle \u0438 Mozilla \u0441\u043f\u0435\u0448\u043d\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u0433\u0440\u043e\u0437\u044b \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445\n\n\ud83d\udcac Google \u0438 Mozilla \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 Chrome \u0438 Firefox, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u0434\u0435\u0441\u044f\u0442\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u044c\u044e. \u041e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0439 Chrome 135 \u043f\u043e\u043b\u0443\u0447\u0438\u043b 14 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u0435\u0432\u044f\u0442\u044c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0432\u043d\u0435\u0448\u043d\u0438\u043c\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438. \u0421\u0430\u043c\u0430\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u2014 \u043e\u0448\u0438\u0431\u043a\u0430 CVE-2025-3066, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u0438. \u0422\u0430\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0441\u0431\u043e\u044f\u043c \u0438 \u0434\u0430\u0436\u0435 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, Google \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0440\u0438\u0441\u043a\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0432 Custom Tabs, Intents \u0438 Extensions, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0415\u0449\u0451 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0433\u0430 \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u044b \u043c\u0435\u043d\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u043c\u0438 \u2014 \u043e\u043d\u0438 \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430\u0432\u0438\u0433\u0430\u0446\u0438\u0438, \u0430\u0432\u0442\u043e\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0438 \u0432\u043a\u043b\u0430\u0434\u043e\u043a.\n\n\u0417\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u043f\u043b\u0430\u0442\u0438\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c $18 000, \u043f\u0440\u0438\u0447\u0451\u043c \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0441\u0443\u043c\u043c\u0443 \u2014 $10 000 \u2014 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0424\u0438\u043b\u0438\u043f\u043f \u0411\u0438\u0440 \u0438\u0437 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0412\u0435\u043d\u044b \u0437\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432 Custom Tabs. \u0420\u0430\u0437\u043c\u0435\u0440 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0437\u0430 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u0442\u0430\u043a \u0447\u0442\u043e \u043e\u0431\u0449\u0430\u044f \u0441\u0443\u043c\u043c\u0430 \u0432\u044b\u043f\u043b\u0430\u0442 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0448\u0435.\n\nChrome 135 \u0441\u0435\u0439\u0447\u0430\u0441 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0432\u0435\u0440\u0441\u0438\u044f 135.0.7049.52 \u0434\u043b\u044f Linux \u0438 \u043a\u0430\u043a 135.0.7049.41/42 \u0434\u043b\u044f Windows \u0438 macOS.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, Mozilla \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 Firefox 137, \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0432\u0448\u0438\u0439 \u0432\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0442\u0440\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u2014 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 XSLTProcessor (CVE-2025-3028), \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0430\u043c\u044f\u0442\u044c\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0438 \u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (CVE-2025-3030 \u0438 CVE-2025-3034).\n\n\u0422\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0438 \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0434\u043c\u0435\u043d\u0435 \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0438 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u044f\u0440\u043b\u044b\u043a\u043e\u0432 .url \u0432 Windows.\n\n\u041f\u043e\u043c\u0438\u043c\u043e Firefox, Mozilla \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b: \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b Firefox ESR 128.9, Firefox ESR 115.22, Thunderbird 137 \u0438 Thunderbird ESR 128.9 \u2014 \u0432\u0441\u0435 \u043e\u043d\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0425\u043e\u0442\u044f \u043d\u0438 Google, \u043d\u0438 Mozilla \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442 \u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2025-04-04T07:23:36.000000Z"}, {"uuid": "6e19b489-c0bc-4070-bbad-29bdbabf069c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30346", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/10149", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30346\n\ud83d\udd25 CVSS Score: 5.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.\n\ud83d\udccf Published: 2025-03-21T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-02T22:03:26.875Z\n\ud83d\udd17 References:\n1. https://varnish-cache.org/security/VSV00015.html", "creation_timestamp": "2025-04-02T22:34:37.000000Z"}, {"uuid": "65cc254d-2f84-4c09-beb5-c0c30527b7b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30349", "type": "exploited", "source": "https://t.me/cvedetector/20828", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30349 - Horde IMP Cross-Site Scripting (XSS) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-30349 \nPublished : March 21, 2025, 5:15 p.m. | 1\u00a0hour, 31\u00a0minutes ago \nDescription : Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025. \nSeverity: 7.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T20:09:28.000000Z"}, {"uuid": "d42f6d2c-6c4b-4c19-ba0a-e8f6135b0d49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30348", "type": "seen", "source": "https://t.me/cvedetector/20797", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30348 - Qt QDom encodeText XML String Injection\", \n  \"Content\": \"CVE ID : CVE-2025-30348 \nPublished : March 21, 2025, 7:15 a.m. | 1\u00a0hour, 23\u00a0minutes ago \nDescription : encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data). \nSeverity: 5.8 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T10:07:40.000000Z"}, {"uuid": "89580ea9-c2a8-4d34-a723-b756bdbc8860", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30347", "type": "seen", "source": "https://t.me/cvedetector/20796", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30347 - Varnish Enterprise Out-of-Bounds Read Information Disclosure\", \n  \"Content\": \"CVE ID : CVE-2025-30347 \nPublished : March 21, 2025, 7:15 a.m. | 1\u00a0hour, 23\u00a0minutes ago \nDescription : Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects. \nSeverity: 4.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T10:07:39.000000Z"}, {"uuid": "c3a8c828-cc94-43b9-8b71-4d29210c37fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30346", "type": "seen", "source": "https://t.me/cvedetector/20795", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30346 - Varnish Cache HTTP Desync Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-30346 \nPublished : March 21, 2025, 7:15 a.m. | 1\u00a0hour, 23\u00a0minutes ago \nDescription : Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. \nSeverity: 5.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T10:07:39.000000Z"}, {"uuid": "1928e3e6-a340-4284-9ad9-ff9da3b7f2d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30343", "type": "seen", "source": "https://t.me/cvedetector/20790", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30343 - OpenSlides Directory Traversal Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-30343 \nPublished : March 21, 2025, 6:15 a.m. | 21\u00a0minutes ago \nDescription : A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file or folder as a relative or absolute path (e.g., ../../../etc/passwd), the ZIP archive generated for download converts that title into a path. Depending on the extraction tool used by the user, this might overwrite files locally outside of the chosen directory. \nSeverity: 3.0 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T07:37:07.000000Z"}, {"uuid": "68f3a15a-8635-45a1-b8c2-d4bd1d73fe1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30342", "type": "seen", "source": "https://t.me/cvedetector/20789", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30342 - OpenSlides Cross-Site Scripting (XSS)\", \n  \"Content\": \"CVE ID : CVE-2025-30342 \nPublished : March 21, 2025, 6:15 a.m. | 21\u00a0minutes ago \nDescription : An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly encoded when reflected; however, adding attributes to links is possible, which allows the injection of JavaScript via the onmouseover attribute and others. When a user moves the mouse over such a prepared link, JavaScript is executed in that user's session. \nSeverity: 5.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T07:37:06.000000Z"}, {"uuid": "eaf28bad-f456-4163-85a1-06d8be490f4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30344", "type": "seen", "source": "https://t.me/cvedetector/20788", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30344 - OpenSlides Timing-Based Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2025-30344 \nPublished : March 21, 2025, 6:15 a.m. | 21\u00a0minutes ago \nDescription : An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password (e.g., more than 100 milliseconds). \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T07:37:06.000000Z"}, {"uuid": "0a3dd04b-52c1-4f62-9386-4195793114fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30345", "type": "seen", "source": "https://t.me/cvedetector/20787", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-30345 - OpenSlides Cross-Site Scripting (XSS)\", \n  \"Content\": \"CVE ID : CVE-2025-30345 \nPublished : March 21, 2025, 6:15 a.m. | 21\u00a0minutes ago \nDescription : An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages. \nSeverity: 3.5 | LOW \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-21T07:37:05.000000Z"}, {"uuid": "2589e6e0-83a8-468f-accf-04ca125648e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30349", "type": "published-proof-of-concept", "source": "Telegram/-_T7fiB1UH9VRuMWqeF5wAirAQ9WEH4yGxP0ggrYXPxHLtk", "content": "", "creation_timestamp": "2025-03-28T04:00:06.000000Z"}, {"uuid": "da29dafe-603a-42c6-a673-3d57390c7b81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-30349", "type": "published-proof-of-concept", "source": "Telegram/IpSkdng-DvuBirFh-8nYsY3OgxKRFd_quSrS72XmwTlTwLs", "content": "", "creation_timestamp": "2025-03-28T00:00:06.000000Z"}]}