What’s Vulnerable › Vulnerabilities

CVE-2026-3050: horilla-opensource horilla Leads global.js cross site scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-24 · updated 2026-06-17
• Weakness: CWE-79

Description

A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 1.0.3 is recommended to address this issue. Patch name: fc5c8e55988e89273012491b5f097b762b474546. It is suggested to upgrade the affected component.

Affected products

• horilla-opensource horilla: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: horilla-opensource horilla 1.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/Horilla-opensource/Horilla-crm/commit/fc5c8e55988e89273012491b5f097b762b474546
• https://github.com/Stolichnayer/Horilla-CRM-Stored-XSS
• https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3
• https://vuldb.com/?ctiid.347408
• https://vuldb.com/?id.347408
• https://vuldb.com/?submit.757314

Get alerted when CVE-2026-3050 or the next vulnerability affects your stack