horilla-opensource
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 0
en
Verify to analyze this security profile
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-40867Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published04/21/2026 | SeverityHigh |
CVE-2026-40866Horilla: Unauthorized Document Overwrite via File Upload Endpoint | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published04/21/2026 | SeverityHigh |
CVE-2026-40865Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published04/21/2026 | SeverityHigh |
CVE-2026-3050horilla-opensource horilla Leads global.js cross site scripting | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published02/24/2026 | SeverityMedium |
CVE-2026-3049horilla-opensource horilla Query Parameter global_search.py get redirect | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published02/24/2026 | SeverityMedium |
CVE-2026-24039Horilla's Improper Access Control Allows Employees to Auto-Approve Documents | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24038Horilla HR has 2FA Bypass through its OTP Handling Logic | Exploitation statusNot known exploited | FixYes | Affected producthorilla | Published01/22/2026 | SeverityHigh |
CVE-2026-24037Horilla HRM has XSS Bypass through Project Name | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24036Horilla Exposes Unpublished Job Disclosures through Unauthenticated API | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24035Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24034Horilla has File Upload XSS | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published01/22/2026 | SeverityMedium |
CVE-2026-24010Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published01/22/2026 | SeverityHigh |
CVE-2025-59832Horrila Stored XSS Vulnerability via Ticket Comment section | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published09/25/2025 | SeverityCritical |
CVE-2025-59525Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover | Exploitation statusNot known exploited | FixYes | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-59524Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-48867Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published09/24/2025 | SeverityMedium |
CVE-2025-48869Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control | Exploitation statusPublic exploit | FixNot confirmed | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-48868Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive | Exploitation statusPublic exploit | FixYes | Affected producthorilla | Published09/24/2025 | SeverityHigh |
CVE-2025-47789Horilla Open Redirect Vulnerability in Login | Exploitation statusNot known exploited | FixNot confirmed | Affected producthorilla | Published05/15/2025 | SeverityMedium |