{"id":"CVE-2025-30090","aliases":["EUVD-2025-9540","GHSA-rj9p-v8v3-qjg9","UBUNTU-CVE-2025-30090"],"status":"published","title":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows...","description":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0027,"percentile":0.19484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-04-02T00:00:00Z","modified":"2026-06-17T09:08:08Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.4.23~svn20120406-2","2:1.4.23~svn20120406-2+deb8u1build0.14.04.1","2:1.4.23~svn20120406-2+deb8u2build0.14.04.1","2:1.4.23~svn20120406-2+deb8u3build0.14.04.1","2:1.4.23~svn20120406-2+deb8u3ubuntu0.14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squirrelmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.4.23~svn20120406-2","2:1.4.23~svn20120406-2ubuntu1","2:1.4.23~svn20120406-2ubuntu1.16.04.1","2:1.4.23~svn20120406-2+deb8u1ubuntu0.16.04.1","2:1.4.23~svn20120406-2+deb8u2build0.16.04.1","2:1.4.23~svn20120406-2+deb8u2ubuntu0.16.04.2","2:1.4.23~svn20120406-2+deb8u2ubuntu0.16.04.3","2:1.4.23~svn20120406-2+deb8u3ubuntu0.16.04.1","2:1.4.23~svn20120406-2+deb8u3ubuntu0.16.04.2"]}],"products":[{"vendor":"squirrelmail","product":"squirrelmail"}],"references":[{"url":"https://squirrelmail.org","tags":["report"]},{"url":"https://squirrelmail.org/security/issue.php?d=2025-04-02","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30090"},{"url":"https://github.com/advisories/GHSA-rj9p-v8v3-qjg9"},{"url":"https://ubuntu.com/security/CVE-2025-30090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30090","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-30090","description":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.","status":"published","published":"2025-04-02T00:00:00Z","modified":"2025-04-02T13:27:48.268Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-9540","description":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.","status":"published","published":"2025-04-02T00:00:00Z","modified":"2025-04-02T13:27:48Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:45.339497Z"}],"ghsa":[{"id":"GHSA-rj9p-v8v3-qjg9","title":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows...","description":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.","status":"published","published":"2025-04-02T15:31:37Z","modified":"2025-04-02T15:31:44Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:00:36.145205Z"}],"nvd":[{"id":"CVE-2025-30090","description":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.","status":"published","published":"2025-04-02T13:15:44.73Z","modified":"2026-06-17T09:08:08.697Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:58.094557Z"}],"osv":[{"id":"UBUNTU-CVE-2025-30090","description":"mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishandled after $encoded has been set to true.","status":"published","published":"2025-04-02T13:15:00Z","modified":"2025-10-24T05:18:10Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"}]}}