Hortusfox: >> Hortusfox Security Vulnerabilities
A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.
CVSS Score
6.1
EPSS Score
0.0
Published
2025-08-13
A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-08-13
HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads.
CVSS Score
5.4
EPSS Score
0.0
Published
2025-01-23