Horilla-opensource vulnerabilities

Products

• Horilla 20

Newest

• horilla-opensource horilla Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation CVE-2026-40867 7.1 HighApril 21, 2026
• horilla-opensource horilla Horilla: Unauthorized Document Overwrite via File Upload Endpoint CVE-2026-40866 8.6 HighApril 21, 2026
• horilla-opensource horilla Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> CVE-2026-40865 7.1 HighApril 21, 2026
• horilla horilla-opensource horilla Leads global.js cross site scripting CVE-2026-3050 5.1 MediumFebruary 24, 2026
• horilla horilla-opensource horilla Query Parameter global_search.py get redirect CVE-2026-3049 5.3 MediumFebruary 24, 2026
• horilla Horilla's Improper Access Control Allows Employees to Auto-Approve Documents CVE-2026-24039 4.3 MediumJanuary 22, 2026
• horilla Horilla HR has 2FA Bypass through its OTP Handling Logic CVE-2026-24038 8.1 HighJanuary 22, 2026
• horilla Horilla HRM has XSS Bypass through Project Name CVE-2026-24037 4.8 MediumJanuary 22, 2026
• horilla Horilla Exposes Unpublished Job Disclosures through Unauthenticated API CVE-2026-24036 5.3 MediumJanuary 22, 2026
• horilla Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee CVE-2026-24035 4.3 MediumJanuary 22, 2026
• horilla Horilla has File Upload XSS CVE-2026-24034 5.4 MediumJanuary 22, 2026
• horilla Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover CVE-2026-24010 8.8 HighJanuary 22, 2026
• horilla Horrila Stored XSS Vulnerability via Ticket Comment section CVE-2025-59832 9.9 CriticalSeptember 25, 2025
• horilla Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover CVE-2025-59525 7.7 HighSeptember 24, 2025
• horilla Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel CVE-2025-59524 7.7 HighSeptember 24, 2025
• horilla Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules CVE-2025-48867 4.8 MediumSeptember 24, 2025
• horilla Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control CVE-2025-48869 7.5 HighSeptember 24, 2025
• horilla Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive CVE-2025-48868 Public exploit 7.2 HighSeptember 24, 2025
• horilla Horilla Open Redirect Vulnerability in Login CVE-2025-47789 6.1 MediumMay 15, 2025
• horilla horilla create_skills deserialization CVE-2024-12138 5.3 MediumDecember 4, 2024