Read the docs

Hortusfox

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Hortusfox records in CISA KEV

No Hortusfox vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Hortusfox 6 records HIGH

Records

6 records

TI-2025-28755 CVE-2025-45316 · GHSA-qfm4-ph66-9pj6

A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of…

Priority MEDIUM 60

A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0033 Published 2025-08-13 No fix listed CWE-79
TI-2025-28753 CVE-2025-45314 · GHSA-qvqv-jrgg-7m2x

A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web…

Priority MEDIUM 60

A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add f…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00258 Published 2025-08-13 No fix listed CWE-79
TI-2025-28752 CVE-2025-45313 · GHSA-q762-9fxh-qw85

A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4…

Priority MEDIUM 60

A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title pa…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00251 Published 2025-08-13 No fix listed CWE-79
TI-2025-28754 CVE-2025-45315 · GHSA-pqvj-8746-9mv8

A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of…

Priority MEDIUM 58

A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected in…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00291 Published 2025-08-13 No fix listed CWE-79
Open these records in search →