Vulnerability record · CVE-2025-30223 · published 31 March 2025

CVE-2025-30223: Beego cross-site scripting vulnerability

Beego · Beego

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

9.6 CVSS 3.1 Critical EPSS 0.59% · top 53.8% CWE-79 · Cross-site scripting

9.6CVSS 3.1 base score

0.59%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Beego Beego

References

Link	Tags
https://github.com/beego/beego/commit/939bb18c66406466715ddadd25dd9ffa6f169e25	Patch
https://github.com/beego/beego/security/advisories/GHSA-2j42-h78h-q4fg	ExploitVendor Advisory

Track CVE-2025-30223 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-31836Beego path traversal vulnerabilityThe leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.EPSS 1.7%5 Jul 2022 9.8CVE-2022-31259Beego vulnerabilityThe route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configur…EPSS 22%21 May 2022 9.8CVE-2021-30080Beego vulnerabilityAn issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.EPSS 1.3%5 Apr 2022 8.8CVE-2024-40464Beego improper certificate validation vulnerabilityAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go fileEPSS 0.57%31 Jul 2024 8.8CVE-2024-40465Beego broken cryptographic algorithm vulnerabilityAn issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileEPSS 0.43%31 Jul 2024 7.8CVE-2021-27116Beego link following vulnerabilityAn issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.EPSS 0.44%5 Apr 2022 7.8CVE-2021-27117Beego link following vulnerabilityAn issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.EPSS 0.44%5 Apr 2022 6.9CVE-2024-55885Beego broken cryptographic algorithm vulnerabilitybeego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no lon…EPSS 0.35%12 Dec 2024

Source: NIST National Vulnerability Database (record CVE-2025-30223), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.