PT-2026-40245 · Horilla · Horilla Hrm

Publicado 2026-05-12 · Atualizado 2026-05-12 · CVE-2026-41513

NVD

CVSS v4.0

4.8

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-41513

Produtos afetados

Horilla Hrm

Referências · 3

• https://github.com/horilla/horilla-hr/commit/734f0c7ed4ac96fe8615d1b592180ea8a46eb8b6 · Nota
• https://github.com/horilla/horilla-hr/security/advisories/GHSA-vqg4-fc32-cwvw · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-41513 · Nota de Segurança