PT-2025-39325 · Horilla · Horilla

Gikyon + 2 · Published 2025-09-24 · Updated 2025-09-25 · CVE-2025-59525

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.4.0

Description Horilla is a Human Resource Management System (HRMS). Improper sanitization within the application allows for Cross-Site Scripting (XSS) through uploaded SVG files and allowed <embed> tags. This can lead to the execution of JavaScript when users view affected content, such as announcements, potentially resulting in administrative account takeover.

Recommendations Update to version 1.4.0 or later.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2025-59525

GHSA-RP5M-VPQR-VPVP

Affected Products

Horilla

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59525.json · Exploit
• 🔥 https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rp5m-vpqr-vpvp · Exploit
• 🔥 https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59525/2025-08-Horilla_Vulnerability_2.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59525 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59525 · Vendor Advisory
• https://github.com/horilla-opensource/horilla/releases/tag/1.4.0 · Note
• https://twitter.com/VulmonFeeds/status/1971051334603288770 · Twitter Post
• https://twitter.com/CVEnew/status/1970996075998990357 · Twitter Post
• https://t.me/CVEtracker/33289 · Telegram Post