Product by Horilla-opensource

    Horilla

    19 known vulnerabilities in Horilla (Horilla-opensource), 0 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Horilla (Horilla-opensource)
    HighCVE-2025-48868

    Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive

    also in 1 other product

    		7.2
    CriticalCVE-2025-59832

    Horrila Stored XSS Vulnerability via Ticket Comment section

    also in 1 other product

    		9.9
    HighCVE-2026-24010

    Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover

    also in 1 other product

    		8.8
    HighCVE-2026-24038

    Horilla HR has 2FA Bypass through its OTP Handling Logic

    also in 1 other product

    		8.1
    HighCVE-2026-40866

    Horilla: Unauthorized Document Overwrite via File Upload Endpoint

    		—
    HighCVE-2025-48869

    Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

    also in 1 other product

    		7.5
    HighCVE-2025-59524

    Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel

    also in 1 other product

    		6.1
    MediumCVE-2026-24036

    Horilla Exposes Unpublished Job Disclosures through Unauthenticated API

    also in 1 other product

    		5.3
    HighCVE-2025-59525

    Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

    also in 1 other product

    		6.1
    HighCVE-2026-40867

    Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation

    		—
    MediumCVE-2026-3049

    horilla-opensource horilla Query Parameter global_search.py get redirect

    also in 1 other product

    		4.3
    HighCVE-2026-40865

    Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>

    		—
    MediumCVE-2026-24034

    Horilla has File Upload XSS

    also in 1 other product

    		5.4
    MediumCVE-2026-3050

    horilla-opensource horilla Leads global.js cross site scripting

    also in 1 other product

    		3.5
    MediumCVE-2025-47789

    Horilla Open Redirect Vulnerability in Login

    also in 1 other product

    		6.1
    MediumCVE-2026-24037

    Horilla HRM has XSS Bypass through Project Name

    also in 1 other product

    		4.8
    MediumCVE-2026-24035

    Horilla: Improper Access Control

    also in 1 other product

    		4.3
    MediumCVE-2026-24039

    Horilla's Improper Access Control Allows Employees to Auto-Approve Documents

    also in 1 other product

    		4.3
    MediumCVE-2025-48867

    Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules

    also in 1 other product

    		4.8

    All products by Horilla-opensource