Cross-Site Scripting Vulnerability in hortusfox-web by Daniel Brendel
CVE-2025-45315

5.4MEDIUM

Key Information:

Vendor: Daniel Brendel
Status: hortusfox-web
Vendor: CVE Published:; 13 August 2025

🔔 Create Daniel Brendel Vulnerability Alert

What is CVE-2025-45315?

A cross-site scripting (XSS) vulnerability exists in the /controller/admin.php endpoint of hortusfox-web v4.4. This flaw permits attackers to inject customized payloads through the email parameter, enabling them to execute arbitrary JavaScript within the context of a user's browser. This could lead to unauthorized actions or data theft if successfully exploited, posing significant risks to user security and privacy.

References

https://github.com/danielbrendel/hortusfox-web

https://github.com/danielbrendel/hortusfox-web/blob/8ab85...

https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-...

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 13, 2025
Vulnerability Reserved
Apr 22, 2025

CVE-2025-45315 Data

JSON