Read the docs

danielbrendel

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

danielbrendel records in CISA KEV

No danielbrendel vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2026-62636 CVE-2026-92980 · GHSA-mhp6-2rq5-c7vj

HortusFox-Web < 6.1 Remote Code Execution via Import/Export

Priority MEDIUM 41

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionalit…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00981 Published 2026-09-17 Fixed in 6.1 CWE-434
TI-2026-68443 CVE-2026-104069 · GHSA-6h79-56ph-ww3m

Remote code execution in HortusFox via theme import

Priority MEDIUM 40

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensio…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00531 Published 2026-10-06 Fixed in 6.2 CWE-434
TI-2026-70059 CVE-2026-108101

Unrestricted file upload in HortusFox lets users store scripts

Priority LOW 36

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00499 Published 2026-10-09 No fix listed CWE-434
TI-2026-70058 CVE-2026-108100

SQL injection in HortusFox API lets token holders read database tables

Priority LOW 31

HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00336 Published 2026-10-09 Fixed in 6.2 CWE-89
TI-2026-50818 CVE-2026-72559 · GHSA-3fwq-xc2g-q79x

Daniel Brendel HortusFox - Cross-Site Scripting

Priority LOW 24

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00226 Published 2026-08-11 No fix listed CWE-79
Open these records in search →