CVE-2026-3050

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3050
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3050.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3050
Published
2026-02-24T01:02:09.321Z
Modified
2026-07-15T01:49:01.419732496Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
horilla-opensource horilla Leads global.js cross site scripting
Details

A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 1.0.3 is recommended to address this issue. Patch name: fc5c8e55988e89273012491b5f097b762b474546. It is suggested to upgrade the affected component.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3050.json",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/horilla/horilla-crm

Affected ranges

Type
GIT
Repo
https://github.com/horilla/horilla-crm
Events
Introduced
5afd2a48a5156c319d96cdf00ef6b23afd07180c
Fixed
fc5c8e55988e89273012491b5f097b762b474546
Fixed
329c3b041583dde4fcec6c159d7775a574c1356d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3050.json"