CVE-2025-59832

Published September 25th, 2025

View on NVD ↗

CVSS v3

9.9

CRITICAL

CVSS v2

N/A

Affected

PROJECTS

Description

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.

horilla/horilla-hr

Horilla is a free and open source HR and CRM software.

GitHub

1.24K

Mmo-kali/CVE

GitHub