CVE-2025-48867
MEDIUM EPSS 12.9%
Published Sep 24, 20259mo ago · Modified Jun 17, 20261w ago
4.8 CVSS 3.1
Published Sep 24, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago
Description
Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads persist in the database and are executed when viewed by an admin or other privileged users through the web interface. Although the issue is not exploitable by unauthenticated users, it still poses a high risk of session hijacking and unauthorized action within high-privilege accounts. At time of publication there is no known patch.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
12.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| horilla | horilla | 1.3 | any |
References 1
- github.com https://github.com/horilla-opensource/horilla/security/advisories/GHSA-w242-xv47-j55r
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.