CVE-2026-71483 Details
Description
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.
A reflected cross-site scripting (XSS) vulnerability has been identified in Horilla HR and CRM software versions prior to 1.6.0. The issue arises in the employee filter view, specifically at the '/employee/employee-filter-view' endpoint. The vulnerability allows an external attacker to inject and execute malicious JavaScript by crafting a link that exploits the search parameter. This injected script runs in the context of the victim's browser, potentially accessing session data and performing actions within the application using the victim's privileges.
Users can update to Horilla version 1.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/horilla/horilla-hr/security/advisories/GHSA-rw86-x8hq-xgwh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/horilla/horilla-hr/commit/39ed01306341a1f6b7702df2825ab5431b5401a9 | [email protected] | Source CodeVendor |
| https://github.com/horilla/horilla-hr/security/advisories/GHSA-rw86-x8hq-xgwh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Horilla | < 1.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 29, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |