XSS Vulnerability in Horilla HRMS Version 1.4.0 by Horilla
CVE-2026-24037

4.8MEDIUM

Key Information:

Vendor

Horilla-opensource

Status
Horilla
Vendor
CVE Published:
22 January 2026

What is CVE-2026-24037?

Horilla HRMS, a free and open-source Human Resource Management System, is vulnerable to Cross-Site Scripting (XSS) in version 1.4.0. The flawed has_xss() function attempts to mitigate XSS threats through regex patterns. However, these patterns are incomplete and context-agnostic, allowing attackers to bypass the checks. As a result, users can be redirected to malicious websites, enabling the execution of external JavaScript and the potential theft of CSRF tokens, which could facilitate CSRF attacks against administrative accounts. The issue has been rectified in version 1.5.0.

Affected Version(s)

horilla >= 1.4.0, < 1.5.0

References

https://github.com/horilla-opensource/horilla/security/ad...
x_refsource_CONFIRM
https://github.com/horilla-opensource/horilla/releases/ta...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.