All packages
hortusfox-web vulnerabilities
3 known CVE vulnerabilities in hortusfox-web, translated and rated.
- CVE-2025-45313Medium
An XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the title parameter. The attack can be executed without authentication if the endpoint does not require authorization.
- CVE-2025-45315Medium
An XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the email parameter, which executes in the victim's browser.
- CVE-2025-45314Medium
An XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to inject malicious JavaScript via the add function, executing in the victim's browser.