Skip to content
OpenAdvisories

Vendor

Daniel Brendel

5 known vulnerabilities.

Products

hortusfox-web 4 HortusFox 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-108101

    HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

    HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files v…

    Daniel Brendel hortusfox-web
  • High 7.2
    CVE-2026-104069

    HortusFox < 6.2 Remote Code Execution via Theme Import

    HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authent…

    Daniel Brendel hortusfox-web
  • High 7.2
    CVE-2026-92980

    HortusFox-Web < 6.1 Remote Code Execution via Import/Export

    HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Ex…

    Daniel Brendel hortusfox-web