hortusfox-web vulnerabilities

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, intended solely for data portability, to deploy and execute malicious code on the underlying application server host.

An XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the title parameter. The attack can be executed without authentication if the endpoint does not require authorization.

An XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the email parameter, which executes in the victim's browser.

An XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the add function, executing in the victim's browser.