CVE-2026-108100

Name of the Vulnerable Software and Affected Versions HortusFox (hortusfox-web) versions prior to 6.2

Description An SQL injection issue exists where API token holders can execute arbitrary SQL commands. By providing crafted values to the include info variable at the '/api/locations/list' endpoint, attackers can insert subqueries that the getSpecificInfo() function in PlantsModel concatenates into the column list. This allows for the unauthorized reading of any database table, including user password hashes.

Recommendations Update HortusFox (hortusfox-web) to version 6.2 or later. As a temporary mitigation, restrict access to the '/api/locations/list' endpoint or avoid using the include info parameter.