CyberRota Analysis
AI-GeneratedThe vulnerability affects the Java-based Horilla HR and CRM software, specifically in the employee filter view where user input is not properly sanitized, allowing for reflected cross-site scripting (XSS) attacks. An external attacker can exploit this flaw to execute arbitrary JavaScript in the context of an authenticated user's session, potentially compromising sensitive session data and performing actions with the victim's privileges. Organizations using versions prior to 1.6.0 should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.