Hhorilla-opensource

Products

Exploited and recent CVEs

• CVE-2026-40867 High 7.1 Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation 0.2%
• CVE-2026-40866 High 8.6 Horilla: Unauthorized Document Overwrite via File Upload Endpoint 0.2%
• CVE-2026-40865 High 7.1 Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> 0.2%
• CVE-2026-3050 Low 3.5 horilla-opensource horilla Leads global.js cross site scripting 0.3%
• CVE-2026-3049 Medium 4.3 horilla-opensource horilla Query Parameter global_search.py get redirect 0.4%
• CVE-2026-24039 Medium 4.3 Horilla's Improper Access Control Allows Employees to Auto-Approve Documents 0.3%
• CVE-2026-24038 High 8.1 Horilla HR has 2FA Bypass through its OTP Handling Logic 0.5%
• CVE-2026-24037 Medium 4.8 Horilla HRM has XSS Bypass through Project Name 0.3%
• CVE-2026-24036 Medium 5.3 Horilla Exposes Unpublished Job Disclosures through Unauthenticated API 0.5%
• CVE-2026-24035 Medium 4.3 Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee 0.3%
• CVE-2026-24034 Medium 5.4 Horilla has File Upload XSS 0.2%
• CVE-2026-24010 High 8.8 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover 0.5%
• CVE-2025-59832 Critical 9.9 Horrila Stored XSS Vulnerability via Ticket Comment section 0.4%
• CVE-2025-59525 High 7.7 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover 0.3%
• CVE-2025-59524 High 7.7 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel 0.3%
• CVE-2025-48867 Medium 4.8 Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules 0.2%
• CVE-2025-48869 High 7.5 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control 0.4%
• CVE-2025-48868 High 7.2 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive 2.5%
• CVE-2025-47789 Medium 6.1 Horilla Open Redirect Vulnerability in Login 0.2%