CVE-2025-59525CWE-434CWE-79

Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover

High · published September 24, 2025

CVSS v4.0
7.7
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG (and via allowed <embed>), which can be chained to execute JavaScript whenever users view impacted content (e.g., announcements). This can result in admin account takeover. This issue has been patched in version 1.4.0.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
EPSS
0.00290 · 20.5th percentile
Weaknesses
CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-09-24T18:15Z
EPSS history
Timeline
  • 24 SEP 18:15Z
    Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover
    cvelistv5