CyberRota Analysis
AI-GeneratedA stored cross-site scripting vulnerability in HortusFox 5.9 affects authenticated workspace members, allowing them to inject persistent JavaScript into plant notes. This unescaped rendering exposes all users, including administrators, to potential session cookie theft and unauthorized actions. Organizations using this version of HortusFox should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can use this to steal session cookies or perform actions in the context of other users including administrators.