Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Hortusfox Clear all filters
TI-2025-28755 CVE-2025-45316 · GHSA-qfm4-ph66-9pj6

A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of…

Priority MEDIUM 60

A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0033 Published 2025-08-13 No fix listed CWE-79
TI-2025-28754 CVE-2025-45315 · GHSA-pqvj-8746-9mv8

A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of…

Priority MEDIUM 58

A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected in…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00291 Published 2025-08-13 No fix listed CWE-79
TI-2025-28753 CVE-2025-45314 · GHSA-qvqv-jrgg-7m2x

A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web…

Priority MEDIUM 60

A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add f…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00258 Published 2025-08-13 No fix listed CWE-79
TI-2025-28752 CVE-2025-45313 · GHSA-q762-9fxh-qw85

A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4…

Priority MEDIUM 60

A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title pa…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00251 Published 2025-08-13 No fix listed CWE-79