horilla
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 5
en
Verify to analyze this security profile
As of 10/06/2026, horilla recorded 5 security vulnerabilities in the last 90 days across 1 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, horilla-hr had the most security vulnerabilities in the horilla ecosystem, with 5 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-86066Horilla attendance approval endpoint is vulnerable to cross-site request forgery | Exploitation statusPublic exploit | FixYes | Affected producthorilla-hr | Published09/25/2026 | SeverityMedium |
CVE-2026-96795Horilla: Authenticated RCE in Horilla List-View Export | Exploitation statusPublic exploit | FixYes | Affected producthorilla-hr | Published09/25/2026 | SeverityHigh |
CVE-2026-71483Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View | Exploitation statusPublic exploit | FixYes | Affected producthorilla-hr | Published09/25/2026 | SeverityHigh |
CVE-2026-63432Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata | Exploitation statusPublic exploit | FixYes | Affected producthorilla-hr | Published09/25/2026 | SeverityMedium |
CVE-2026-63431Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR) | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla-hr | Published09/25/2026 | SeverityMedium |
CVE-2026-41513Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla-hr | Published05/12/2026 | SeverityMedium |
CVE-2026-3050horilla-opensource horilla Leads global.js cross site scripting | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published02/24/2026 | SeverityMedium |
CVE-2026-3049horilla-opensource horilla Query Parameter global_search.py get redirect | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published02/24/2026 | SeverityMedium |
CVE-2026-24039Horilla's Improper Access Control Allows Employees to Auto-Approve Documents | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24038Horilla HR has 2FA Bypass through its OTP Handling Logic | Exploitation statusNot known exploited | FixYes | Affected producthorilla | Published01/22/2026 | SeverityHigh |
CVE-2026-24037Horilla HRM has XSS Bypass through Project Name | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24036Horilla Exposes Unpublished Job Disclosures through Unauthenticated API | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24035Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24034Horilla has File Upload XSS | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24010Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published01/22/2026 | SeverityHigh |
CVE-2025-59832Horrila Stored XSS Vulnerability via Ticket Comment section | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published09/25/2025 | SeverityCritical |
CVE-2025-59525Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover | Exploitation statusNot known exploited | FixYes | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-59524Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-48867Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published09/24/2025 | SeverityMedium |
CVE-2025-48869Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-48868Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-47789Horilla Open Redirect Vulnerability in Login | Exploitation statusNot known exploited | FixNot confirmed | Affected producthorilla | Published05/15/2025 | SeverityMedium |
CVE-2024-12138horilla create_skills deserialization | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published12/04/2024 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan