CVE-2025-48867

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-48867

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48867.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-48867

Aliases

GHSA-w242-xv47-j55r

Published

2025-09-24T17:25:42Z

Modified

2026-08-27T03:57:04Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules

Details

Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads persist in the database and are executed when viewed by an admin or other privileged users through the web interface. Although the issue is not exploitable by unauthenticated users, it still poses a high risk of session hijacking and unauthorized action within high-privilege accounts. At time of publication there is no known patch.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48867.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "= 1.3.0"
                },
                {
                    "last_affected": "= 1.3.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/horilla/horilla-hr

Affected ranges

Type

GIT

Repo

https://github.com/horilla/horilla-hr

Events

Introduced

1349e4e5f9cf51edb8508801aa3844eab4edfa8c

Last Affected

1349e4e5f9cf51edb8508801aa3844eab4edfa8c

Database specific

Show details

{
    "cpe": "cpe:2.3:a:horilla:horilla:1.3:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.3"
        },
        {
            "last_affected": "1.3"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48867.json"