CVE-2026-72559

HortusFox 5.9 contains a stored cross-site scripting vulnerability that lets authenticated workspace members inject persistent JavaScript into plant notes. Parsedown rendering without safe mode renders notes unescaped for every user viewing the affected plant, enabling potential session cookie th...

EUVD-2026-56029

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

CVE-2026-72559 Daniel Brendel HortusFox - Cross-Site Scripting

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

CVE-2026-72559 Daniel Brendel HortusFox - Cross-Site Scripting

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

PT-2026-70134

Name of the Vulnerable Software and Affected Versions HortusFox version 5.9 Description A stored cross-site scripting issue allows authenticated workspace members to inject persistent JavaScript into plant notes. This occurs because Parsedown is rendered without safe mode, causing notes to be...