Medium severity · published Mar 21, 2025
CVE-2025-30345
An issue was discovered in OpenSlides before 4.2.5
4.1
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openslides · Openslides
before 4.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30345
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30345
Exploit
https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides
More from Openslides
9.8
CVE-2026-25519
OpenSlides has incorrect access control vulnerability in authentication service
8.9
CVE-2020-26280
OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies
7.5
CVE-2024-22893
OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime
7.5
CVE-2024-22892
OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords
6.5
CVE-2025-30343
A directory traversal issue was discovered in OpenSlides before 4.2.5