How to: CVE-2025-30349 (2025-03-21)
```
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
```
- [natasaka/CVE-2025-30349](https://github.com/natasaka/CVE-2025-30349)