Horilla vulnerabilities

Products

• Horilla 17
• Horilla-hr 6

Newest

• horilla horilla-hr Horilla attendance approval endpoint is vulnerable to cross-site request forgery CVE-2026-86066 5.9 MediumSeptember 25, 2026
• horilla horilla-hr Horilla: Authenticated RCE in Horilla List-View Export CVE-2026-96795 8.8 HighSeptember 25, 2026
• horilla horilla-hr Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View CVE-2026-71483 8.5 HighSeptember 25, 2026
• horilla horilla-hr Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata CVE-2026-63432 6.5 MediumSeptember 25, 2026
• horilla horilla-hr Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR) CVE-2026-63431 6.5 MediumSeptember 25, 2026
• horilla horilla-hr Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints CVE-2026-41513 4.8 MediumMay 12, 2026
• horilla horilla-opensource horilla Leads global.js cross site scripting CVE-2026-3050 5.1 MediumFebruary 24, 2026
• horilla horilla-opensource horilla Query Parameter global_search.py get redirect CVE-2026-3049 5.3 MediumFebruary 24, 2026
• horilla Horilla's Improper Access Control Allows Employees to Auto-Approve Documents CVE-2026-24039 4.3 MediumJanuary 22, 2026
• horilla Horilla HR has 2FA Bypass through its OTP Handling Logic CVE-2026-24038 8.1 HighJanuary 22, 2026
• horilla Horilla HRM has XSS Bypass through Project Name CVE-2026-24037 4.8 MediumJanuary 22, 2026
• horilla Horilla Exposes Unpublished Job Disclosures through Unauthenticated API CVE-2026-24036 5.3 MediumJanuary 22, 2026
• horilla Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee CVE-2026-24035 4.3 MediumJanuary 22, 2026
• horilla Horilla has File Upload XSS CVE-2026-24034 5.4 MediumJanuary 22, 2026
• horilla Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover CVE-2026-24010 8.8 HighJanuary 22, 2026
• horilla Horrila Stored XSS Vulnerability via Ticket Comment section CVE-2025-59832 9.9 CriticalSeptember 25, 2025
• horilla Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover CVE-2025-59525 7.7 HighSeptember 24, 2025
• horilla Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel CVE-2025-59524 7.7 HighSeptember 24, 2025
• horilla Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules CVE-2025-48867 4.8 MediumSeptember 24, 2025
• horilla Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control CVE-2025-48869 7.5 HighSeptember 24, 2025
• horilla Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive CVE-2025-48868 Public exploit 7.2 HighSeptember 24, 2025
• horilla Horilla Open Redirect Vulnerability in Login CVE-2025-47789 6.1 MediumMay 15, 2025
• horilla horilla create_skills deserialization CVE-2024-12138 5.3 MediumDecember 4, 2024