CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...

CVE-2025-45314

A cross-site scripting (XSS) vulnerability exists in the /Calendar endpoint of hortusfox-web v4.4 . The root cause is the improper neutralization of input within the add function, which allows an attacker to execute arbitrary JavaScript in a user's browser via a crafted payload. As a temporary wo...