Stored XSS Vulnerability in Horilla Human Resource Management System

CVE-2025-59832

What is CVE-2025-59832?

Horilla, an open-source Human Resource Management System, has a stored XSS vulnerability in its ticket comment editor. This flaw allows low-privilege authenticated users to inject arbitrary JavaScript code. When an admin views a compromised comment, the malicious script can execute in the admin's browser, potentially allowing the attacker to exfiltrate sensitive information such as cookies and CSRF tokens, leading to session hijacking. The vulnerability has been resolved in version 1.4.0, emphasizing the importance of upgrading to patched versions to safeguard against potential attacks.

References