CVE-2024-57329

Published: Jan 23, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads.

Affected (1)

Products: Hortusfox: Hortusfox

Hortusfox

1 product

Hortusfox

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hortusfox Hortusfox	Version 3.9

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://github.com/fatihtuzunn/CVEs/tree/main/CVE-2024-57329

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.