Security readout for executives and security teams
Plain-English summary
CVE-2025-45313 is a cross-site scripting issue reported in hortusfox-web v4.4. An attacker could place malicious JavaScript in a task title and have it run in another user’s browser. This is not described as server takeover, but it can affect user sessions, data viewed in the application, and trust in the system.
Executive priority
Treat as a moderate web application risk. Prioritize if hortusfox-web is internet-facing, widely used internally, or handles sensitive operational data. Confirm exposure and vendor remediation status before escalating beyond normal patch management.
Technical view
The reported flaw is CWE-79 XSS in the /tasks endpoint of hortusfox-web v4.4 via the title parameter. CVSS 3.1 is 6.1: network reachable, low complexity, no privileges required, user interaction required, changed scope, low confidentiality and integrity impact, no availability impact.
Likely exposure
Exposure is likely limited to organizations running hortusfox-web v4.4 with user-accessible task creation or task viewing workflows. The source bundle does not provide CPEs, broader affected versions, deployment details, or a vendor patch reference.
Exploitation context
The CVE record does not indicate known active exploitation, and it is not listed as KEV in the provided bundle. Exploitation requires a user to interact with or view crafted content in the application context.
Researcher notes
Public data is sparse. The CVE names hortusfox-web v4.4 and the affected endpoint and parameter, but the structured affected-product fields are empty. No patch, commit, advisory, or exploitation-in-the-wild evidence is included in the provided sources.
Mitigation direction
- Check hortusfox-web project guidance for a fixed release or official workaround.
- Restrict application access to trusted users until vendor guidance is confirmed.
- Apply output encoding and input validation for task titles if maintaining a custom fork.
- Review Content Security Policy as a compensating control, not a primary fix.
- Educate users to avoid untrusted task links or unexpected task content.
Validation and detection
- Inventory hortusfox-web deployments and confirm whether v4.4 is in use.
- Review /tasks handling of the title parameter for encoding on output.
- Perform safe, authorized XSS testing in a non-production environment.
- Check application logs for suspicious task title submissions.
- Monitor the CVE and project repository for updated remediation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-45313 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-45313/CVE-2025-45313.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.