Advisories · Technology
horilla-hr.
Every CVE that names horilla-hr among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.9 Medium
Horilla attendance approval endpoint is vulnerable to cross-site request forgery
- horilla-hr
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Horilla: Authenticated RCE in Horilla List-View Export
- horilla-hr
- Code injection
- CVSS 8.5 High
Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
- horilla-hr
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata
- horilla-hr
- Code injection
- Information disclosure
- CVSS 6.5 Medium
Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)
- horilla-hr
- Broken access control
- CVSS 4.8 Medium
Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints
- horilla-hr
- Open redirect