CVE-2025-45315

MediumCVSS 5.4

Published: 13/08/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

An XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the email parameter, which executes in the victim's browser.

Risk Assessment

Attackers can hijack user sessions, steal credentials, or perform other malicious actions in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately update hortusfox-web to the latest version and implement input validation and output encoding for the email parameter in the /controller/admin.php endpoint.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.