CVE-2025-45313

12th percentile - higher than 12% of all known CVEs

An XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the title parameter. The attack can be executed without authentication if the endpoint does not require authorization.

The risk includes session hijacking, data theft, or unauthorized actions in the victim's browser context. This could compromise data confidentiality and integrity within the organization.

Immediately update hortusfox-web to the latest patched version. As a temporary measure, validate and sanitize the title parameter input in the /tasks endpoint.