What’s Vulnerable › Products

horilla-hr vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your horilla-hr version is affected

Latest horilla-hr vulnerabilities

• CVE-2026-96795 — Horilla: Authenticated RCE in Horilla List-View Export (CVSS 8.8)
• CVE-2026-86066 — Horilla attendance approval endpoint is vulnerable to cross-site request forgery (CVSS 5.9)
• CVE-2026-71483 — Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View (CVSS 8.5)
• CVE-2026-63432 — Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata (CVSS 6.5)
• CVE-2026-63431 — Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR) (CVSS 6.5)
• CVE-2026-41513 — Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints (CVSS 4.8)