Stored XSS Vulnerability in Horilla HRM by Horilla

CVE-2025-48867

What is CVE-2025-48867?

A stored cross-site scripting vulnerability in Horilla HRM version 1.3.0 allows authenticated administrators or privileged users to inject malicious JavaScript payloads into various fields of the Project and Task modules. These harmful scripts persist in the database and execute whenever the affected pages are accessed by users with high privileges. Although unauthenticated users cannot exploit this vulnerability, it represents a significant threat, enabling potential session hijacking and unauthorized actions within high-privilege accounts. At this time, there is no known patch available.

References