What is the CVSS score of CVE-2025-30345?

CVE-2025-30345 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openslides are affected by CVE-2025-30345?

CVE-2025-30345 is a low-severity vulnerability in OpenSlides (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

Is there a public PoC exploit available for CVE-2025-30345?

Yes, a public proof-of-concept exploit is available for CVE-2025-30345. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-30345?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Openslides CVE-2025-30345

LOW

Improper Encoding or Escaping of Output (CWE-116)

2025-03-21 cve@mitre.org

Information Disclosure Openslides

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:32 vuln.today

PoC Detected

Mar 27, 2025 - 14:38 vuln.today

Public exploit code

CVE Published

Mar 21, 2025 - 06:15 nvd

LOW 3.5

DescriptionCVE.org

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.

AnalysisAI

An issue was discovered in OpenSlides before 4.2.5. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-116. An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages. Affected products include: Openslides. Version information: before 4.2.5..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2025-30345 vulnerability details – vuln.today

Back