CVE-2025-45315 is a cross-site scripting vulnerability affecting hortusfox-web version 4.4. The issue occurs in the /controller/admin.php endpoint where the email parameter is not properly sanitized, enabling attackers with limited privileges to inject and execute arbitrary JavaScript code in the context of other users' browsers. This can lead to partial confidentiality and integrity impacts but does not affect availability. The vulnerability requires user interaction and is exploitable remotely over the network.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to theft of sensitive information or manipulation of web content within the affected application session. The confidentiality and integrity of user data may be partially compromised. There is no impact on system availability. The attack requires the victim to interact with a crafted payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing additional input validation or output encoding on the email parameter if possible.