PT-2025-23926 · Joomla · Rsmail!

Kamil Szczurowski + 1 · Published 2025-06-05 · Updated 2025-08-13 · CVE-2025-30084

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RSMail! component versions 1.19.20 through 1.22.26 for Joomla

Description A stored XSS issue was discovered in the RSMail! component for Joomla, where user-supplied input is not properly sanitized before being stored and rendered within the dashboard component. This allows an attacker to inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who interacts with the crafted text in the dashboard.

Recommendations For RSMail! component versions 1.19.20 through 1.22.26, consider disabling the dashboard component until a patch is available to prevent exploitation. Restrict access to the text fields or other input points in the dashboard to minimize the risk of malicious code injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-30084

Affected Products

Rsmail!

References · 7

• https://osv.dev/vulnerability/CVE-2025-30084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30084 · Security Note
• https://twitter.com/VulmonFeeds/status/1930651252498542769 · Twitter Post
• https://t.me/cveNotify/132068 · Telegram Post
• https://twitter.com/CVEnew/status/1930623763248558583 · Twitter Post
• https://rsjoomla.com · Note
• https://t.me/cvetracker/25515 · Telegram Post