chrisWalker11/Cves

Releases0

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-70296 ↗	Feb 11, 2026Wednesday, 11 February 2026, 19:15	5.4 MEDIUM	—
A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.
CVE-2025-70297 ↗	Feb 11, 2026Wednesday, 11 February 2026, 19:15	6.1 MEDIUM	—
A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser.
CVE-2025-45313 ↗	Aug 13, 2025Wednesday, 13 August 2025, 19:15	6.1 MEDIUM	—
A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.
CVE-2025-50946 ↗	Aug 13, 2025Wednesday, 13 August 2025, 18:15	6.5 MEDIUM	—
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.
CVE-2025-45314 ↗	Aug 13, 2025Wednesday, 13 August 2025, 18:15	6.1 MEDIUM	—
A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function.
CVE-2025-45315 ↗	Aug 13, 2025Wednesday, 13 August 2025, 18:15	5.4 MEDIUM	—
A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.
CVE-2025-45316 ↗	Aug 13, 2025Wednesday, 13 August 2025, 18:15	6.1 MEDIUM	—
A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
CVE-2025-45317 ↗	Aug 13, 2025Wednesday, 13 August 2025, 18:15	6.5 MEDIUM	—
A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive.