CVE-2025-45315
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the email parameter, which executes in the victim's browser.
Risk Assessment
Attackers can hijack user sessions, steal credentials, or perform other malicious actions in the victim's browser context, compromising data confidentiality and integrity.
Recommendation
Immediately update hortusfox-web to the latest version and implement input validation and output encoding for the email parameter in the /controller/admin.php endpoint.
Other vulnerabilities in hortusfox-web
See all- CVE-2026-92980High
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, intended solely for data portability, to deploy and execute malicious code on the underlying application server host.
- CVE-2025-45313Medium
An XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the title parameter. The attack can be executed without authentication if the endpoint does not require authorization.
- CVE-2025-45314Medium
An XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the add function, executing in the victim's browser.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS