How severe is CVE-2025-30223?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.3 out of 10.

What type of vulnerability is CVE-2025-30223?

This is classified as CWE-79, which is a common weakness in software security.

CVE-2025-30223 - CRITICAL Severity | CVSS 9.3

Vulnerability Description

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

Related Vulnerabilities

CVE-2014-3919

CRITICAL

CVSS:9.3(Critical)

A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information.

CWE-792014

CVE-2019-17535

CRITICAL

CVSS:9.3(Critical)

Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.

CWE-792019

CVE-2019-18345

CRITICAL

CVSS:9.3(Critical)

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked ...

CWE-792019

CVE-2020-15178

CRITICAL

CVSS:9.3(Critical)

In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, po...

CWE-792020

CVE-2020-3955

CRITICAL

CVSS:9.3(Critical)

ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluate...

CWE-792020

CVE-2021-0268

CRITICAL

CVSS:9.3(Critical)

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') weakness in J-web of Juniper Networks Junos OS leads to buffer overflows, segment faults, or other impacts, whi...

CWE-792021