Horilla vulnerabilities
We track 3 vulnerabilities in Horilla products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2026.
Latest Horilla vulnerabilities
- 8.8 High severity
horilla-hr: Improper Control of Generation of Code
Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes
- 8.5 High severity
horilla-hr: Improper Neutralization of Input During Web Page Generation
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that
- 8.8 High severity
A vulnerability classified as critical was found in horilla up to 1.2.1.
A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimbursement/key_result_current_value_update/create_meetings/create_skills. The manipulation leads to deseri