PatchTheCVE: hortusfoxhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-45313: A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to exhttps://patchthecve.com/cve/CVE-2025-45313.htmlhttps://patchthecve.com/cve/CVE-2025-45313.htmlSun, 05 Jul 2026 01:21:44 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.CVE-2025-45317: A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to https://patchthecve.com/cve/CVE-2025-45317.htmlhttps://patchthecve.com/cve/CVE-2025-45317.htmlWed, 17 Jun 2026 09:25:28 +0000MEDIUM 6.5: A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive.CVE-2025-45316: A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows ahttps://patchthecve.com/cve/CVE-2025-45316.htmlhttps://patchthecve.com/cve/CVE-2025-45316.htmlWed, 17 Jun 2026 09:25:27 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.CVE-2025-45315: A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows https://patchthecve.com/cve/CVE-2025-45315.htmlhttps://patchthecve.com/cve/CVE-2025-45315.htmlSun, 05 Jul 2026 01:21:45 +0000MEDIUM 5.4: A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.CVE-2025-45314: A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers tohttps://patchthecve.com/cve/CVE-2025-45314.htmlhttps://patchthecve.com/cve/CVE-2025-45314.htmlSun, 05 Jul 2026 01:21:44 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function.CVE-2024-57329: HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" functionhttps://patchthecve.com/cve/CVE-2024-57329.htmlhttps://patchthecve.com/cve/CVE-2024-57329.htmlWed, 17 Jun 2026 08:13:29 +0000MEDIUM 5.4: HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads.