Skip to contentHorilla-opensource Horilla vulnerabilities
- horilla-opensource horillaHorilla: Unauthorized Helpdesk Attachment Access via Attachment ID ManipulationCVE-2026-408677.1 High
- horilla-opensource horillaHorilla: Unauthorized Document Overwrite via File Upload EndpointCVE-2026-408668.6 High
- horilla-opensource horillaHorilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>CVE-2026-408657.1 High
- horillahorilla-opensource horilla Leads global.js cross site scriptingCVE-2026-30505.1 Medium
- horillahorilla-opensource horilla Query Parameter global_search.py get redirectCVE-2026-30495.3 Medium
- horillaHorilla's Improper Access Control Allows Employees to Auto-Approve DocumentsCVE-2026-240394.3 Medium
- horillaHorilla HR has 2FA Bypass through its OTP Handling LogicCVE-2026-240388.1 High
- horillaHorilla HRM has XSS Bypass through Project NameCVE-2026-240374.8 Medium
- horillaHorilla Exposes Unpublished Job Disclosures through Unauthenticated APICVE-2026-240365.3 Medium
- horillaHorilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another EmployeeCVE-2026-240354.3 Medium
- horillaHorilla has File Upload XSSCVE-2026-240345.4 Medium
- horillaHorilla has HTML Injection Issue that, with Phishing, Leads to Account TakeoverCVE-2026-240108.8 High
- horillaHorrila Stored XSS Vulnerability via Ticket Comment sectionCVE-2025-598329.9 Critical
- horillaHorilla has Improper Input Sanitization Leading to XSS and Admin Account TakeoverCVE-2025-595257.7 High
- horillaHorilla Stored XSS Vulnerability via File Upload in Reimbursement PanelCVE-2025-595247.7 High
- horillaHorilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task ModulesCVE-2025-488674.8 Medium
- horillaHorilla Unauthorized Access to Candidate Resume Files Due to Broken Access ControlCVE-2025-488697.5 High
- horillaHorilla vulnerable to authenticated RCE via eval() in project_bulk_archiveCVE-2025-48868Public exploit7.2 High
- horillaHorilla Open Redirect Vulnerability in LoginCVE-2025-477896.1 Medium
- horillahorilla create_skills deserializationCVE-2024-121385.3 Medium