What’s Vulnerable › Vulnerabilities

CVE-2025-59525: Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-24 · updated 2026-06-17
• Weakness: CWE-79

Description

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG (and via allowed <embed>), which can be chained to execute JavaScript whenever users view impacted content (e.g., announcements). This can result in admin account takeover. This issue has been patched in version 1.4.0.

Affected products

• horilla-opensource horilla: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: horilla-opensource horilla 1.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59525/2025-08-Horilla_Vulnerability_2.pdf
• https://github.com/horilla-opensource/horilla/releases/tag/1.4.0
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rp5m-vpqr-vpvp

Get alerted when CVE-2025-59525 or the next vulnerability affects your stack