PT-2026-3913 · Horilla · Horilla

Whoisshuvam · Publicado 2026-01-22 · Atualizado 2026-01-29 · CVE-2026-24037

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.5.0

Description Horilla is a Human Resource Management System (HRMS). The has xss() function in version 1.4.0 attempts to prevent Cross-Site Scripting (XSS) by using regular expressions to filter input. However, these regular expressions are insufficient and do not consider the context of the input, allowing attackers to bypass the filtering mechanism. Successful exploitation can lead to redirecting users to malicious domains, executing external JavaScript, and stealing Cross-Site Request Forgery (CSRF) tokens. These stolen tokens can then be used to perform Cross-Site Request Forgery attacks against administrators.

Recommendations Horilla versions prior to 1.5.0 should be updated to version 1.5.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-24037

GHSA-RQW5-FJM4-RGVM

Produtos afetados

Horilla

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24037.json · Exploit
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Nota
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2014215341044330672 · Publicação no Twitter
• https://t.me/cveNotify/150307 · Publicação no Telegram
• https://twitter.com/lsof/status/2014399082362515949 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014196244646679019 · Publicação no Twitter
• https://t.me/CVEtracker/42740 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24037 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24037 · Aviso do Fabricante
• https://t.me/cveNotify/149520 · Publicação no Telegram