CVE-2026-71483

Received Received - Intake

Stored XSS in Horilla HR and CRM Software

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-71483

Affected Vendors & Products

Vendor	Product	Version / Range
horilla	hr_and_crm_software	1.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Horilla HR and CRM software versions prior to 1.6.0. It involves a reflected cross-site scripting (XSS) flaw where the search parameter at /employee/employee-filter-view is rendered using jQuery's .html() method without proper sanitization. This allows an attacker to inject malicious JavaScript code via a crafted link.

Detection Guidance

To detect this vulnerability, inspect the /employee/employee-filter-view endpoint for reflected input in employee/templates/employee_nav.html. Check if user-controlled data is rendered via jQuery .html() without sanitization. Monitor network traffic for suspicious links leading to this endpoint.

Impact Analysis

An attacker can trick an authenticated employee or administrator into clicking a malicious link, which executes arbitrary JavaScript in their browser. This can lead to session hijacking, unauthorized actions performed with the victim's privileges, and exposure of sensitive browser data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, non-compliance penalties, and loss of trust due to insufficient input validation and output encoding.

Mitigation Strategies

Upgrade Horilla to version 1.6.0 or later to patch the vulnerability. If upgrading is not immediately possible, implement input validation and output encoding for the search parameter at /employee/employee-filter-view. Disable or restrict access to the vulnerable endpoint if feasible.

Hi! I’m here to help you understand CVE-2026-71483. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70