CVE-2025-45316: XSS
Published Aug 13, 2025
·Updated
A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
Affected Software
2 affected components
HortusFox hortusfox-web
HortusFox HortusFox=4.4
Event History
Aug 13, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs to induce a user to interact with content containing a crafted payload in the name parameter. No prior privileges are required, and the attack can be performed remotely.
2
What is the likely impact if exploitation succeeds?
Injected scripts or HTML can execute in the affected user's browser. The CVSS vector indicates low confidentiality and integrity impact, with scope changed and no availability impact.
3
Which versions are identified as affected?
The provided information identifies hortusfox-web version 4.4. It does not provide a fixed version or a broader affected-version range.