horilla-opensource

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

horilla-opensource records in CISA KEV

No horilla-opensource vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Horilla 17 records HIGH

Records

26 records

TI-2025-37271 CVE-2025-59832

Horrila Stored XSS Vulnerability via Ticket Comment section

HIGH 76

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00423 Published 2025-09-25 Fixed in 1.4.0 CWE-79

TI-2026-63868 CVE-2026-96795

Horilla: Authenticated RCE in Horilla List-View Export

HIGH 73

Horilla is an HR and CRM software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00386 Published 2026-09-25 Fixed in 2.0.0 CWE-94

TI-2026-50095 CVE-2026-71483

Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

HIGH 72

Horilla is an HR and CRM software.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00344 Published 2026-09-25 Fixed in 1.6.0 CWE-79

TI-2026-29522 CVE-2026-40866

Horilla: Unauthorized Document Overwrite via File Upload Endpoint

HIGH 72

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00207 Published 2026-04-21 No fix listed CWE-284

TI-2025-31025 CVE-2025-48869

Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

HIGH 72

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00433 Published 2025-09-24 No fix listed CWE-284

TI-2026-29521 CVE-2026-40865

Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>

HIGH 70

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00174 Published 2026-04-21 No fix listed CWE-284

TI-2026-19348 CVE-2026-24010

Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover

HIGH 70

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00469 Published 2026-01-22 Fixed in 1.5.0 CWE-474

TI-2025-37055 CVE-2025-59524

Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel

HIGH 67

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00349 Published 2025-09-24 Fixed in 1.4.0 CWE-434

TI-2025-31024 CVE-2025-48868

Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive

HIGH 67

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02473 Published 2025-09-24 No fix listed CWE-95

TI-2026-29523 CVE-2026-40867

Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation

MEDIUM 64

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00207 Published 2026-04-21 No fix listed CWE-284

TI-2026-19365 CVE-2026-24036

Horilla Exposes Unpublished Job Disclosures through Unauthenticated API

MEDIUM 63

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00503 Published 2026-01-22 Fixed in 1.5.0 CWE-284

TI-2026-58876 CVE-2026-86066

Horilla attendance approval endpoint is vulnerable to cross-site request forgery

MEDIUM 62

Horilla is an HR and CRM software.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.0025 Published 2026-09-25 Fixed in 2.0.0 CWE-352

TI-2026-45210 CVE-2026-63432

Information disclosure in horilla-opensource horilla-hr

MEDIUM 62

Horilla is an HR and CRM software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00401 Published 2026-09-25 Fixed in 1.6.0, 2.0.0 CWE-200

TI-2026-45209 CVE-2026-63431

Missing authorization in horilla-opensource horilla-hr

MEDIUM 62

Horilla is an HR and CRM software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00213 Published 2026-09-25 No fix listed CWE-862

TI-2026-19366 CVE-2026-24037

Horilla HRM has XSS Bypass through Project Name

MEDIUM 58

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00259 Published 2026-01-22 Fixed in 1.5.0 CWE-79

TI-2026-19363 CVE-2026-24034

Horilla has File Upload XSS

MEDIUM 58

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00247 Published 2026-01-22 Fixed in 1.5.0 CWE-434

TI-2026-30096 CVE-2026-41513

Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints

MEDIUM 55

Horilla is an HR and CRM software.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00335 Published 2026-05-12 No fix listed CWE-601

TI-2025-31023 CVE-2025-48867

Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules

MEDIUM 55

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0024 Published 2025-09-24 No fix listed CWE-79

TI-2026-19368 CVE-2026-24039

Horilla's Improper Access Control Allows Employees to Auto-Approve Documents

MEDIUM 53

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00267 Published 2026-01-22 Fixed in 1.5.0 CWE-284

TI-2026-19364 CVE-2026-24035

Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee

MEDIUM 53

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00314 Published 2026-01-22 Fixed in 1.5.0 CWE-284

TI-2026-19367 CVE-2026-24038

Horilla HR has 2FA Bypass through its OTP Handling Logic

LOW 38

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00482 Published 2026-01-22 Fixed in 1.5.0 CWE-287

TI-2025-37056 CVE-2025-59525

Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

LOW 33

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.0029 Published 2025-09-24 Fixed in 1.4.0 CWE-434

TI-2025-30254 CVE-2025-47789

Horilla Open Redirect Vulnerability in Login

LOW 27

Horilla is a free and open source Human Resource Management System (HRMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00228 Published 2025-05-15 No fix listed CWE-601

TI-2024-11257 CVE-2024-12138 · GHSA-8j4v-284w-97cc

horilla create_skills deserialization

LOW 25

A vulnerability classified as critical was found in horilla up to 1.2.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00736 Published 2024-12-04 No fix listed CWE-20

TI-2026-02633 CVE-2026-3049 · GHSA-cqj6-j4f4-mcpp

horilla-opensource horilla Query Parameter global_search.py get redirect

LOW 24

A vulnerability was detected in horilla-opensource horilla up to 1.0.2.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0044 Published 2026-02-24 Fixed in 1.0.3 CWE-601

Open these records in search →