horilla-opensource vulnerabilities

CVEs per yearBy the year they were published

1. 20257
2. 202612

Newest CVEs

• CVE-2026-40867

  Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation

  horilla-opensource · horilla

  High7.1
• CVE-2026-40866

  Horilla: Unauthorized Document Overwrite via File Upload Endpoint

  horilla-opensource · horilla

  High8.6
• CVE-2026-40865

  Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>

  horilla-opensource · horilla

  High7.1
• CVE-2026-3050

  horilla-opensource horilla Leads global.js cross site scripting

  horilla-opensource · horilla

  Medium5.1
• CVE-2026-3049

  horilla-opensource horilla Query Parameter global_search.py get redirect

  horilla-opensource · horilla

  Medium5.3
• CVE-2026-24039

  Horilla's Improper Access Control Allows Employees to Auto-Approve Documents

  horilla-opensource · horilla

  Medium4.3
• CVE-2026-24038

  Horilla HR has 2FA Bypass through its OTP Handling Logic

  horilla-opensource · horilla

  High8.1
• CVE-2026-24037

  Horilla HRM has XSS Bypass through Project Name

  horilla-opensource · horilla

  Medium4.8
• CVE-2026-24036

  Horilla Exposes Unpublished Job Disclosures through Unauthenticated API

  horilla-opensource · horilla

  Medium5.3
• CVE-2026-24035

  Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee

  horilla-opensource · horilla

  Medium4.3