CVE-2025-45316

Опубликовано: 13 авг. 2025

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.

Ссылки

https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45316/CVE-2025-45316.md
Exploit
Third Party Advisory
https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/models/ChatMsgModel.php#L47
Product
https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/modules/TextBlockModule.php#L15
Product
https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/modules/TextBlockModule.php#L201
Product
https://github.com/danielbrendel/hortusfox-web/blob/8ab851101a62d8eb311235c118eeeb32a9b36978/app/views/chat.php#L66
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:hortusfox:hortusfox:4.4:*:*:*:*:*:*:*

EPSS

Процентиль: 13%

0.00042

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-qfm4-ph66-9pj6