Danielbrendel Hortusfox-Web
4 CVEs affecting Danielbrendel Hortusfox-Web. Latest disclosed: 2026-10-09. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-108101 | High | 7.5 | 2026-10-09 | HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files… |
CVE-2026-104069 | High | 7.2 | 2026-10-06 | HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the… |
CVE-2026-92980 | High | 7.2 | 2026-09-17 | HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as… |
CVE-2026-108100 | Medium | 6.5 | 2026-10-09 | HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info valu… |