CVE-2025-45313 describes a cross-site scripting (XSS) vulnerability in hortusfox-web version 4.4. The vulnerability occurs at the /tasks endpoint where the title parameter does not properly sanitize input, enabling attackers to inject malicious JavaScript code. This can lead to script execution in the victim's browser session, impacting confidentiality and integrity but not availability. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they access the vulnerable endpoint with a crafted payload. This can lead to theft of sensitive information accessible in the browser context or manipulation of the user interface. There is no indication of impact to system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input on the /tasks endpoint. Implementing input validation and output encoding on the title parameter can help mitigate the risk.