Horrila Stored XSS Vulnerability via Ticket Comment section
Priority HIGH 76CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed horilla (horilla-opensource): 1.4.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| horilla-opensource | horilla | before 1.4.0 | 1.4.0 | Patch available | CNA |
- horilla Vendorhorilla-opensource Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:horilla:horilla:*:*:*:*:*:*:*:* | before 1.4.0 | Vulnerable | horilla-opensource |
- cpe:2.3:a:horilla:horilla:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·horilla-opensource
Remediation
- Fix · CNA horilla (horilla-opensource) Fixed in 1.4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59832
References
More horilla-opensource Horilla vulnerabilities
- TI-2025-31025 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control CVSS 3.1HIGH 7.5
- TI-2026-19348 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover CVSS 3.1HIGH 8.0
- TI-2025-37055 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel CVSS 4.0HIGH 7.7
- TI-2025-31024 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive CVSS 3.1HIGH 7.2
- TI-2026-19365 Horilla Exposes Unpublished Job Disclosures through Unauthenticated API CVSS 3.1MEDIUM 5.3
- TI-2026-19366 Horilla HRM has XSS Bypass through Project Name CVSS 3.1MEDIUM 5.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences