CVE-2025-48867 Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules
Authenticated admins can inject malicious scripts into project fields, leading to session hijacking of other privileged users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-48867?
CVE-2025-48867 is a medium-severity cross-site scripting vulnerability in horilla-opensource horilla, published on 24 Sep 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads persist in the database and are executed when viewed by an admin or other privileged users through the web interface. Although the issue is not exploitable by unauthenticated users, it still poses a high risk of session hijacking and unauthorized action within high-privilege accounts. At time of publication there is no known patch.
Weakness: CWE-79
Which versions are affected by CVE-2025-48867?
It affects 1 product.
Products include Horilla Horilla.
How do I fix CVE-2025-48867?
No fix has been published for CVE-2025-48867 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-48867 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48867 exists.
Other vulnerabilities in horilla-opensource horilla
- CVE-2025-59832 Horrila Stored XSS Vulnerability via Ticket Comment section
- CVE-2026-24010 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover
- CVE-2026-24038 Horilla HR has 2FA Bypass through its OTP Handling Logic
- CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel
- CVE-2025-59525 Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover
Sources
Also known as GHSA-w242-xv47-j55r.