horilla-hr vulnerabilities

2 known vulnerabilities in horilla-hr from Horilla. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  horilla-hr: Improper Control of Generation of Code

  CVE-2026-96795Sep 25, 2026Horilla

  Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes

• 8.5 High severity

  horilla-hr: Improper Neutralization of Input During Web Page Generation

  CVE-2026-71483Sep 25, 2026Horilla

  Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that