CVE-2025-45314

MediumCVSS 6.1

Published: 13/08/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

An XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the add function, executing in the victim's browser.

Risk Assessment

Attackers can hijack user sessions, steal data, or perform other malicious actions in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately update hortusfox-web to the latest version and implement input filtering and encoding in the add function of the /Calendar endpoint.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function.