CVE-2025-59832— Horrila Stored XSS Vulnerability via Ticket Comment section
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-59832
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Horrila Stored XSS Vulnerability via Ticket Comment section
Source: NVD (National Vulnerability Database)
Vulnerability Description
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Horilla 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Horilla是Horilla公司的一款免费的开源人力资源软件。 Horilla 1.4.0之前版本存在安全漏洞，该漏洞源于票证评论编辑器存在存储型跨站脚本，可能导致低权限用户执行任意JavaScript代码并劫持管理员会话。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| horilla-opensource | horilla | < 1.4.0 | - |
II. Public POCs for CVE-2025-59832
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-59832
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: horilla
- CVE-2026-40867
Horilla: Unauthorized Helpdesk Attachment Access via Attachm - CVE-2026-40866
Horilla: Unauthorized Document Overwrite via File Upload End - CVE-2026-40865
Horilla: Insecure Direct Object Reference at `/employee/view - CVE-2026-3050
horilla-opensource horilla Leads global.js cross site script - CVE-2026-3049
horilla-opensource horilla Query Parameter global_search.py
Same vendor: horilla-opensource
- CVE-2026-40867
Horilla: Unauthorized Helpdesk Attachment Access via Attachm - CVE-2026-40866
Horilla: Unauthorized Document Overwrite via File Upload End - CVE-2026-40865
Horilla: Insecure Direct Object Reference at `/employee/view - CVE-2026-3050
horilla-opensource horilla Leads global.js cross site script - CVE-2026-3049
horilla-opensource horilla Query Parameter global_search.py
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2025-59832
No comments yet