Vulnerability · Published Sep 24, 2025 · Assigned by GitHub_M

CVE-2025-59525Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

High 7.7

In plain English

A high-severity cross-site scripting in horilla from horilla-opensource. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG (and via allowed <embed>), which can be chained to execute JavaScript whenever users view impacted content (e.g., announcements). This can result in admin account takeover. This issue has been patched in version 1.4.0.

Affected products (as reported)

Vendor	Product	Versions
horilla-opensource	horilla	< 1.4.0

Weakness: CWE-79, CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

References

https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rp5m-vpqr-vpvp x_refsource_CONFIRM
https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59525/2025-08-Horilla_Vulnerability_2.pdf x_refsource_MISC
https://github.com/horilla-opensource/horilla/releases/tag/1.4.0 x_refsource_MISC