PT-2026-21595 · Unknown · Horilla-Opensource

Alexperrakis · Publicado 2026-02-24 · Atualizado 2026-02-24 · CVE-2026-3049

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions horilla-opensource horilla versions up to 1.0.2

Description A flaw exists in the Query Parameter Handler component of horilla-opensource horilla. Specifically, the get function within the horilla generics/global search.py file is susceptible to an open redirect condition. Manipulation of the prev url argument can lead to exploitation. The exploit is publicly available.

Recommendations Upgrade to version 1.0.3.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-3049

Produtos afetados

Horilla-Opensource

Referências · 10

• 🔥 https://github.com/Stolichnayer/Horilla-CRM-Open-Redirect · Exploit
• https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3 · Correção
• https://github.com/horilla-opensource/horilla-crm/commit/730b5a44ff060916780c44a4bdbc8ced70a2cd27 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-3049 · Nota de Segurança
• https://vuldb.com/?submit.757296 · Nota
• https://twitter.com/CVEnew/status/2026184655758819672 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026182011501621541 · Publicação no Twitter
• https://vuldb.com/?id.347407 · Nota
• https://vuldb.com/?ctiid.347407 · Nota
• https://osv.dev/vulnerability/CVE-2026-3049 · Aviso do Fabricante