Vulnerability · Published May 15, 2025 · Assigned by GitHub_M

CVE-2025-47789Horilla Open Redirect Vulnerability in Login

Medium 6.1

In plain English

A medium-severity open redirect in horilla from horilla-opensource. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any arbitrary site, including phishing or malicious domains, which can be used to impersonate Horilla and trick users. Commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
horilla-opensource	horilla	<= 1.3

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/horilla-opensource/horilla/security/advisories/GHSA-cqp5-xx4j-r468 x_refsource_CONFIRM
https://github.com/horilla-opensource/horilla/commit/1c72404df6888bb23af73c767fdaee5e6679ebd6 x_refsource_MISC