CVE-2025-45314 describes a cross-site scripting (XSS) vulnerability in hortusfox-web version 4.4 specifically affecting the /Calendar endpoint. Attackers can exploit this by injecting malicious JavaScript payloads into the add function, which then executes in the victim's browser session. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability. There is no information about an available patch or vendor advisory, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure and integrity compromise of user data within the affected application session. There is no direct impact on system availability. The attack requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content in the /Calendar endpoint. Consider applying web application firewall (WAF) rules to detect and block suspicious input targeting the add function if possible.