What’s Vulnerable › Vulnerabilities

CVE-2025-59832: Horrila Stored XSS Vulnerability via Ticket Comment section

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-25 · updated 2026-10-19
• Weakness: CWE-79

Description

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.

Affected products

• horilla-opensource horilla: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: horilla-opensource horilla 1.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59832/2025-08-Horilla_Vulnerability_1.pdf
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-8x78-6q9g-hv2h
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-8x78-6q9g-hv2h

Get alerted when CVE-2025-59832 or the next vulnerability affects your stack