Quick answers
- Is CVE-2025-45313 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-45313 being exploited in the wild.
- How severe is CVE-2025-45313?
- Medium severity, with a CVSS score of 6.1, published 13 August 2025.
- Which products and versions are affected?
- Hortusfox 4.4.
- Is there a fix for CVE-2025-45313?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-45313 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-45313?
- Check whether you run Hortusfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the 'create task' functionality of hortusfox-web v4.4. The root cause is the lack of sanitization of the $name (task title) variable in the createdTask() method, which is subsequently passed to addToChat() and inserted into the database via a raw SQL query without HTML escaping. When the application broadcasts the new-task message to the system chat, the unescaped payload is rendered in the browsers of all connected users. An attacker can exploit this by injecting a malicious payload (e.g., using <img> tags with onerror attributes) into the task title. This can lead to session hijacking, CSRF token theft, or privilege escalation if an administrator views the chat.
Affected products
- hortusfox hortusfox-web 4.4
Timeline
- 2025-08-13: advisory: Initial NVD publication
- 2025-08-13: disclosed: External researcher disclosure via GitHub