horilla has 6 CVEs on record between 2025 and 2026. 5 were published in the last 90 days. The busiest recent month was September 2026 with 5. The median CVSS is 6.8 (medium). None have a confirmed exploitation report. Most affected products: horilla-hr (5), horilla (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2025-48868High· 7.2Horilla is a free and open source Human Resource Management System (HRMS)52CVE-2026-96795High· 8.8Horilla is an HR and CRM software48CVE-2026-71483High· 8.5Horilla is an HR and CRM software47CVE-2026-63432Medium· 6.5Horilla is an HR and CRM software36CVE-2026-63431Medium· 6.5Horilla is an HR and CRM software36
horilla vulnerabilities
CVEs affecting horilla, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-96795High· 8.8Horilla is an HR and CRM software
Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Pyt…
CVE-2026-86066Medium· 5.9Horilla is an HR and CRM software
Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-reque…
CVE-2026-71483High· 8.5Horilla is an HR and CRM software
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft …
CVE-2026-63432Medium· 6.5Horilla is an HR and CRM software
Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /…
CVE-2026-63431Medium· 6.5Horilla is an HR and CRM software
Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records sel…
CVE-2025-48868High· 7.2PoCHorilla is a free and open source Human Resource Management System (HRMS)
Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query pa…