CVE-2026-3049

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3049
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3049.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3049
Published
2026-02-24T00:32:11.210Z
Modified
2026-07-15T01:49:16.834654190Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
horilla-opensource horilla Query Parameter global_search.py get redirect
Details

A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horillagenerics/globalsearch.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3049.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-601"
    ]
}
References

Affected packages

Git / github.com/horilla/horilla-crm

Affected ranges

Type
GIT
Repo
https://github.com/horilla/horilla-crm
Events
Introduced
5afd2a48a5156c319d96cdf00ef6b23afd07180c
Fixed
730b5a44ff060916780c44a4bdbc8ced70a2cd27
Fixed
329c3b041583dde4fcec6c159d7775a574c1356d
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        }
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3049.json"