PT-2025-39309 · Unknown · Horilla Hrm

Naklehzeidan21 · Published 2025-09-24 · Updated 2025-09-24 · CVE-2025-48867

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Horilla HRM version 1.3.0

Description Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) issue in Horilla HRM version 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields within the Project and Task modules. These payloads are stored in the database and executed when viewed by an admin or other privileged users through the web interface. The issue is not exploitable by unauthenticated users but poses a risk of session hijacking and unauthorized actions within high-privilege accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-48867

GHSA-W242-XV47-J55R

Affected Products

Horilla Hrm

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48867.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-w242-xv47-j55r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48867 · Security Note
• https://t.me/CVEtracker/33269 · Telegram Post
• https://twitter.com/CVEnew/status/1970906973739561342 · Twitter Post