Skip to content
OpenAdvisories

Vendor

danielbrendel

4 known vulnerabilities.

danielbrendel at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 3 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202630
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

hortusfox-web 4
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2026-108101

    HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

    HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files v…

    danielbrendel hortusfox-web
  • Medium 6.5
    CVE-2026-108100

    HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter

    HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which Plants…

    danielbrendel hortusfox-web
  • High 7.2
    CVE-2026-104069

    HortusFox < 6.2 Remote Code Execution via Theme Import

    HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authent…

    danielbrendel hortusfox-web
  • High 7.2
    CVE-2026-92980

    HortusFox-Web < 6.1 Remote Code Execution via Import/Export

    HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Ex…

    danielbrendel hortusfox-web