PT-2026-21595 · Unknown · Horilla-Opensource

Alexperrakis · Published 2026-02-24 · Updated 2026-02-24 · CVE-2026-3049

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions horilla-opensource horilla versions up to 1.0.2

Description A flaw exists in the Query Parameter Handler component of horilla-opensource horilla. Specifically, the get function within the horilla generics/global search.py file is susceptible to an open redirect condition. Manipulation of the prev url argument can lead to exploitation. The exploit is publicly available.

Recommendations Upgrade to version 1.0.3.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-3049

Affected Products

Horilla-Opensource

References · 10

• 🔥 https://github.com/Stolichnayer/Horilla-CRM-Open-Redirect · Exploit
• https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3 · Patch
• https://github.com/horilla-opensource/horilla-crm/commit/730b5a44ff060916780c44a4bdbc8ced70a2cd27 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3049 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3049 · Vendor Advisory
• https://vuldb.com/?submit.757296 · Note
• https://twitter.com/CVEnew/status/2026184655758819672 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026182011501621541 · Twitter Post
• https://vuldb.com/?id.347407 · Note
• https://vuldb.com/?ctiid.347407 · Note