TI-2026-19348 Aliases CVE-2026-24010

Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover

HIGH 70CWE-474Published 2026-01-22 · Updated 2026-01-22

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials. When a victim visits the uploaded file URL, they see an authentic-looking "Session Expired" message prompting them to re-authenticate. All entered credentials are captured and sent to the attacker's server, enabling Account Takeover. Version 1.5.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00469 40th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed horilla (horilla-opensource): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
horilla-opensource	horilla	before 1.5.0	1.5.0	Patch available	CNA

horilla Vendorhorilla-opensource Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:horilla:horilla::::::::	before 1.5.0	Vulnerable	horilla-opensource

cpe:2.3:a:horilla:horilla:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·horilla-opensource

Remediation

Fix · CNA horilla (horilla-opensource) Fixed in 1.5.0

Timeline

2026-10-02 Threatist record created from CVE-2026-24010

References

Exploit 1

https://github.com/horilla-opensource/horilla/security/advisories/GHSA-5jfv-gw8w-49h3

Other 1

https://github.com/horilla-opensource/horilla/releases/tag/1.5.0

TI-2025-37271 Horrila Stored XSS Vulnerability via Ticket Comment section CVSS 3.1CRITICAL 9.9
TI-2025-31025 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control CVSS 3.1HIGH 7.5
TI-2025-37055 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel CVSS 4.0HIGH 7.7
TI-2025-31024 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive CVSS 3.1HIGH 7.2
TI-2026-19365 Horilla Exposes Unpublished Job Disclosures through Unauthenticated API CVSS 3.1MEDIUM 5.3
TI-2026-19366 Horilla HRM has XSS Bypass through Project Name CVSS 3.1MEDIUM 5.4

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences