CVE-2025-45313
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the title parameter. The attack can be executed without authentication if the endpoint does not require authorization.
Risk Assessment
The risk includes session hijacking, data theft, or unauthorized actions in the victim's browser context. This could compromise data confidentiality and integrity within the organization.
Recommendation
Immediately update hortusfox-web to the latest patched version. As a temporary measure, validate and sanitize the title parameter input in the /tasks endpoint.
Other vulnerabilities in hortusfox-web
See all- CVE-2026-92980High
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, intended solely for data portability, to deploy and execute malicious code on the underlying application server host.
- CVE-2025-45315Medium
An XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the email parameter, which executes in the victim's browser.
- CVE-2025-45314Medium
An XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the add function, executing in the victim's browser.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS