Vendor
horilla-opensource
19 known vulnerabilities.
Products
8 results · Clear filters · Feed
-
Medium 4.3
horilla-opensource horilla Query Parameter global_search.py get redirect
A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redir…
-
Medium 4.3
Horilla's Improper Access Control Allows Employees to Auto-Approve Documents
Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self-approve documents they have uploaded. The document-approval UI is intended to be restricted to admi…
-
Medium 4.8
Horilla HRM has XSS Bypass through Project Name
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the has_xss() function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them …
-
Medium 5.3
Horilla Exposes Unpublished Job Disclosures through Unauthenticated API
Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descrip…
-
Medium 4.3
Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee
Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on …
-
Medium 5.4
Horilla has File Upload XSS
Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1…
-
Medium 4.8
Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules
Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in th…
-
Medium 6.1
Horilla Open Redirect Vulnerability in Login
Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. …