CVE-2024-57329

HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 18th percentile

Published

2025-01-23

Updated

2025-01-24

Proof-of-concept exploits (1)

• fatihtuzunn/CVEs/tree/main/CVE-2024-57329

References

• CVE Record
• NVD entry

Related

• CVE-2024-57326
• CVE-2024-57328
• CVE-2024-5733
• CVE-2024-5734
• CVE-2024-5732
• CVE-2024-5735