PT-2026-21612 · Unknown · Horilla-Opensource Horilla

Alexperrakis · Publicado 2026-02-24 · Atualizado 2026-02-24 · CVE-2026-3050

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions horilla-opensource horilla versions up to 1.0.2

Description A security issue exists in horilla-opensource horilla, specifically within the Leads Module. The manipulation of the Notes argument in an unknown function of the file static/assets/js/global.js can lead to cross-site scripting (XSS). This attack can be carried out remotely. The exploit has been published.

Recommendations Upgrade to version 1.0.3 to address this issue.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2026-3050

Produtos afetados

Horilla-Opensource Horilla

Referências · 10

• 🔥 https://github.com/Stolichnayer/Horilla-CRM-Stored-XSS · Exploit
• https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3 · Correção
• https://github.com/Horilla-opensource/Horilla-crm/commit/fc5c8e55988e89273012491b5f097b762b474546 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-3050 · Nota de Segurança
• https://vuldb.com/?ctiid.347408 · Nota
• https://vuldb.com/?id.347408 · Nota
• https://osv.dev/vulnerability/CVE-2026-3050 · Aviso do Fabricante
• https://vuldb.com/?submit.757314 · Nota
• https://twitter.com/VulmonFeeds/status/2026179451533308028 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026184643574480969 · Publicação no Twitter