Filtered by vendor Hortusfox
Subscribe
Total
6 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-45314 | 1 Hortusfox | 1 Hortusfox | 2025-08-18 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function. | |||||
| CVE-2025-45315 | 1 Hortusfox | 1 Hortusfox | 2025-08-18 | N/A | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter. | |||||
| CVE-2025-45316 | 1 Hortusfox | 1 Hortusfox | 2025-08-18 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter. | |||||
| CVE-2025-45317 | 1 Hortusfox | 1 Hortusfox | 2025-08-15 | N/A | 6.5 MEDIUM |
| A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive. | |||||
| CVE-2025-45313 | 1 Hortusfox | 1 Hortusfox | 2025-08-15 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter. | |||||
| CVE-2024-57329 | 1 Hortusfox | 1 Hortusfox | 2025-08-14 | N/A | 5.4 MEDIUM |
| HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads. | |||||