PatchTheCVEhortusfox vulnerabilities and fixes
Recent CVEs affecting hortusfox, with upgrade or downgrade steps. 6 tracked.
hortusfox has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-08-13. Highest priority: CVE-2025-45317 (score 39/100).
- CVE-2025-45315 MEDIUM 5.4 DOWNGRADE A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows
- CVE-2025-45314 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to
- CVE-2025-45313 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to ex
- CVE-2025-45317 MEDIUM 6.5 DOWNGRADE A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to
- CVE-2025-45316 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows a
- CVE-2024-57329 MEDIUM 5.4 DOWNGRADE HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function
FAQ
How do I fix hortusfox vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is hortusfox being exploited right now?
None of the tracked hortusfox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which hortusfox CVE should I patch first?
CVE-2025-45317 currently ranks highest (39/100): A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to .