CVE-2026-24034 Horilla has File Upload XSS

Horilla is a free and open source Human Resource Management System HRMS. In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue...

CVE-2026-24034 Horilla has File Upload XSS

Horilla is a free and open source Human Resource Management System HRMS. In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue...

CVE-2026-24034

CVE-2026-24034 affects Horilla HRMS. In versions prior to 1.5.0, an XSS vulnerability can be triggered during profile photo update because the extension and content-type are not checked. The issue is fixed in 1.5.0. If you use Horilla, upgrade to 1.5.0 or later to mitigate. The provided sources c...

EUVD-2026-4213

Horilla is a free and open source Human Resource Management System HRMS. A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker...

CVE-2026-24010 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker...

CVE-2026-24010 Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover

Horilla is a free and open source Human Resource Management System HRMS. A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker...

CVE-2026-23887

creationtimestamp| type| source ---|---|--- 2026-01-22 02:03:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcy3tkxxgj26...

CVE-2026-24047

creationtimestamp| type| source ---|---|--- 2026-01-22 01:58:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcy3kmkoxq23 2026-01-24 21:22:59+00:00| seen| https://gist.github.com/alon710/4b217fe2cf8ffb61c81cdbc3ae7afb81 2026-01-24 22:19:21+00:00| seen|...

CVE-2025-27377

creationtimestamp| type| source ---|---|--- 2026-01-22 01:34:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcy275dade2g...

CVE-2026-23951

creationtimestamp| type| source ---|---|--- 2026-01-22 01:30:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxzyggnxo2m...

CVE-2026-23986

creationtimestamp| type| source ---|---|--- 2026-01-22 01:21:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxzi6yrtr2t 2026-01-24 21:22:55+00:00| seen| https://gist.github.com/alon710/3f67d5416c0d4f1e17b0e57daa874634 2026-01-24 22:19:02+00:00| seen|...

CVE-2026-24048

creationtimestamp| type| source ---|---|--- 2026-01-22 01:19:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxzdpmxt62m 2026-01-24 21:23:00+00:00| seen| https://gist.github.com/alon710/dcd3cb019a3aa9fac521a1c167378738 2026-01-24 22:19:27+00:00| seen|...

CVE-2026-23736

creationtimestamp| type| source ---|---|--- 2026-01-22 01:16:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxz7lasom2t...

CVE-2026-23630

creationtimestamp| type| source ---|---|--- 2026-01-22 01:14:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxz3qaqqk2n 2026-08-27 20:35:03+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3mu3p4o3wjm2r...

CVE-2026-23946

creationtimestamp| type| source ---|---|--- 2026-01-22 01:07:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxyomszhk2t 2026-01-24 21:23:13+00:00| seen| https://gist.github.com/alon710/4972d5a3d088ec92b983ffaa97796d26 2026-01-24 22:21:08+00:00| seen|...

CVE-2026-24049

creationtimestamp| type| source ---|---|--- 2026-01-22 00:00:15+00:00| published-proof-of-concept| https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx 2026-01-22 07:40:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcyoonkasz26 2026-01-23 12:01:00+00:00| seen|...

CVE-2025-69612

A path traversal vulnerability exists in TMS Management Console version 6.3.7.27386.20250818 from TMS Global Software. The "Download Template" function in the profile dashboard does not neutralize directory traversal sequences ../ in the filePath parameter, allowing authenticated users to read...

Horilla code issue vulnerabilities

Horilla is a free open-source human resources software developed by Horilla Company. Versions of Horilla prior to 1.5.0 contained code vulnerabilities. These vulnerabilities stemmed from the lack of checks for file extensions and content types when updating profile photos, which could lead to...

PT-2026-3909

Horilla is a free and open source Human Resource Management System HRMS. In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue...

CVE-2025-12781

creationtimestamp| type| source ---|---|--- 2026-01-21 21:21:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcxm2tiiqe23 2026-01-22 12:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mcz7ok5mhf2z 2026-03-18 00:00:00+00:00| seen|...