Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-71483— Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Quick assessment

Affected
horilla horilla-hr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Horilla 是一款人力资源（HR）和客户关系管理（CRM）软件。在版本 1.6.0 之前， 接口的搜索参数被直接通过 jQuery 的 方法插入到 中，且未进行 HTML 编码处理（即缺乏 HTML 净化）。攻击者可以构造恶意链接，当认证用户（员工或管理员）访问员工筛选界面时触发 JavaScript 代码执行，从而窃取浏览器可见的会话数据，并在受害者权限范围内执行应用操作。该问题已在版本 1.6.0 中得到修复。

CVSS 8.5 · High EPSS 0.27% · P19

Affected Version Matrix 1

VendorProduct Version RangeStatus
horilla horilla-hr < 1.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-71483

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
Source: CVE Program / CVE List V5
Vulnerability Description
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
horilla horilla-hr < 1.6.0 -

II. Public POCs for CVE-2026-71483

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-71483

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-71483 (1)

Vendor Advisories for CVE-2026-71483 (1)

Same Patch Batch · horilla · 2026-09-25 · 5 CVEs total

CVE-2026-96795 8.8 HIGH Horilla: Authenticated RCE in Horilla List-View Export
CVE-2026-63431 6.5 MEDIUM Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structur
CVE-2026-63432 6.5 MEDIUM Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authentica
CVE-2026-86066 5.9 MEDIUM Horilla attendance approval endpoint is vulnerable to cross-site request forgery

IV. Related Vulnerabilities

Same product: horilla-hr
Same vendor: horilla
Same weakness: CWE-79

V. Comments for CVE-2026-71483

No comments yet

Leave a comment