{"id":"CVE-2025-59832","aliases":["EUVD-2025-31100","GHSA-8x78-6q9g-hv2h"],"status":"published","title":"Horrila Stored XSS Vulnerability via Ticket Comment section","description":"Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00423,"percentile":0.36944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-09-25T14:45:19Z","modified":"2026-10-29T02:48:28Z","products":[{"vendor":"horilla","product":"horilla"},{"vendor":"horilla-opensource","product":"horilla"}],"references":[{"url":"https://github.com/horilla-opensource/horilla/security/advisories/GHSA-8x78-6q9g-hv2h","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59832/2025-08-Horilla_Vulnerability_1.pdf","tags":["x_refsource_MISC","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59832.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59832","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-59832","title":"Horrila Stored XSS Vulnerability via Ticket Comment section","description":"Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.","status":"published","published":"2025-09-25T14:45:19.214Z","modified":"2025-09-25T15:48:38.332Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:47.447481Z"}],"euvd":[{"id":"EUVD-2025-31100","description":"Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.","status":"published","published":"2025-09-25T14:45:19Z","modified":"2025-09-25T15:48:38Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T20:31:39.520931Z"}],"nvd":[{"id":"CVE-2025-59832","description":"Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.","status":"published","published":"2025-09-25T15:16:14.1Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:32.559087Z"}],"osv":[{"id":"CVE-2025-59832","title":"Horrila Stored XSS Vulnerability via Ticket Comment section","description":"Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.","status":"published","published":"2025-09-25T14:45:19.214Z","modified":"2026-10-29T02:48:28.418995571Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:51.516975Z"}]}}