CVE-2026-3050
horilla-opensource horilla Leads global.js cross site scripting
CVSS Score
3.5
EPSS Score
0.0%
EPSS Percentile
0th
A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 1.0.3 is recommended to address this issue. Patch name: fc5c8e55988e89273012491b5f097b762b474546. It is suggested to upgrade the affected component.
| CWE | CWE-79 CWE-94 |
| Vendor | horilla-opensource |
| Product | horilla |
| Published | Feb 24, 2026 |
| Last Updated | Feb 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for horilla-opensource horilla
Be the first to know when new low vulnerabilities affecting horilla-opensource horilla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
horilla-opensource / horilla
1.0.0 1.0.1 1.0.2
References
vuldb.com: https://vuldb.com/?id.347408 vuldb.com: https://vuldb.com/?ctiid.347408 vuldb.com: https://vuldb.com/?submit.757314 github.com: https://github.com/Stolichnayer/Horilla-CRM-Stored-XSS github.com: https://github.com/Horilla-opensource/Horilla-crm/commit/fc5c8e55988e89273012491b5f097b762b474546 github.com: https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3
Credits
🔍 alexperrakis (VulDB User)