CVE-2026-71483
Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.
| CWE | CWE-79 |
| Vendor | horilla |
| Product | horilla-hr |
| Published | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for horilla horilla-hr
Be the first to know when new unknown vulnerabilities affecting horilla horilla-hr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
horilla / horilla-hr
< 1.6.0