PT-2026-3913 · Horilla · Horilla

Whoisshuvam · Published 2026-01-22 · Updated 2026-01-29 · CVE-2026-24037

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.5.0

Description Horilla is a Human Resource Management System (HRMS). The has xss() function in version 1.4.0 attempts to prevent Cross-Site Scripting (XSS) by using regular expressions to filter input. However, these regular expressions are insufficient and do not consider the context of the input, allowing attackers to bypass the filtering mechanism. Successful exploitation can lead to redirecting users to malicious domains, executing external JavaScript, and stealing Cross-Site Request Forgery (CSRF) tokens. These stolen tokens can then be used to perform Cross-Site Request Forgery attacks against administrators.

Recommendations Horilla versions prior to 1.5.0 should be updated to version 1.5.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24037

GHSA-RQW5-FJM4-RGVM

Affected Products

Horilla

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24037.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rqw5-fjm4-rgvm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24037 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24037 · Vendor Advisory
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Note
• https://twitter.com/VulmonFeeds/status/2014215341044330672 · Twitter Post
• https://t.me/cveNotify/150307 · Telegram Post
• https://twitter.com/lsof/status/2014399082362515949 · Twitter Post
• https://twitter.com/CVEnew/status/2014196244646679019 · Twitter Post
• https://t.me/CVEtracker/42740 · Telegram Post
• https://t.me/cveNotify/149520 · Telegram Post