Browse all 6 CVE security advisories affecting horilla. AI-powered Chinese analysis, POCs, and references for each vulnerability.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-86066 | Horilla attendance approval endpoint is vulnerable to cross-site request forgery — horilla-hr CWE-352 | 5.9 | Medium | 2026-09-25 |
| CVE-2026-96795 | Horilla: Authenticated RCE in Horilla List-View Export — horilla-hr CWE-94 | 8.8 | High | 2026-09-25 |
| CVE-2026-71483 | Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View — horilla-hr CWE-79 | 8.5 | High | 2026-09-25 |
| CVE-2026-63432 | Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata — horilla-hr CWE-94 | 6.5 | Medium | 2026-09-25 |
| CVE-2026-63431 | Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR) — horilla-hr CWE-862 | 6.5 | Medium | 2026-09-25 |
| CVE-2026-41513 | Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints — horilla-hr CWE-601 | - | - | 2026-05-12 |
This page lists every published CVE security advisory associated with horilla. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.