hortusfox-web vulnerabilities
3 known vulnerabilities in hortusfox-web from Danielbrendel. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
hortusfox-web: Unrestricted Upload of File with Dangerous Type
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files vi
- 7.2 High severity
hortusfox-web: Unrestricted Upload of File with Dangerous Type
HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenti
- 7.2 High severity
hortusfox-web: Unrestricted Upload of File with Dangerous Type
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Exp