PT-2026-21612 · Unknown · Horilla-Opensource Horilla

Alexperrakis · Published 2026-02-24 · Updated 2026-02-24 · CVE-2026-3050

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions horilla-opensource horilla versions up to 1.0.2

Description A security issue exists in horilla-opensource horilla, specifically within the Leads Module. The manipulation of the Notes argument in an unknown function of the file static/assets/js/global.js can lead to cross-site scripting (XSS). This attack can be carried out remotely. The exploit has been published.

Recommendations Upgrade to version 1.0.3 to address this issue.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-3050

Affected Products

Horilla-Opensource Horilla

References · 10

• 🔥 https://github.com/Stolichnayer/Horilla-CRM-Stored-XSS · Exploit
• https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3 · Patch
• https://github.com/Horilla-opensource/Horilla-crm/commit/fc5c8e55988e89273012491b5f097b762b474546 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3050 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3050 · Vendor Advisory
• https://vuldb.com/?ctiid.347408 · Note
• https://vuldb.com/?id.347408 · Note
• https://vuldb.com/?submit.757314 · Note
• https://twitter.com/VulmonFeeds/status/2026179451533308028 · Twitter Post
• https://twitter.com/CVEnew/status/2026184643574480969 · Twitter Post