Horilla-opensource vulnerabilities
We track 8 vulnerabilities in Horilla-opensource products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on April 21, 2026.
Latest Horilla-opensource vulnerabilities
- 7.1 High severity
horilla: Improper Access Control
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. Thi
- 8.6 High severity
horilla: Improper Access Control
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by ch
- 7.1 High severity
horilla: Improper Access Control
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in
- 8.1 High severity
horilla: Improper Authentication
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from thei
- 8.0 High severity
horilla: Unrestricted Upload of File with Dangerous Type
Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disgu
- 9.9 Critical severity
horilla: Improper Neutralization of Input During Web Page Generation
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfilt
- 7.5 High severity
horilla: Improper Access Control
Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing
- 7.2 High severity
horilla: Improper Neutralization of Directives in Dynamically Evaluated Code
Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project_