CVE-2026-3049mediumCWE-601

CVE-2026-3049: falha de média gravidade em horilla-opensource horilla

horilla-opensource horilla Query Parameter global_search.py get redirect

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar horilla

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
horilla-opensource · horilla
CVEs relacionadas — horilla-opensource horilla

No mesmo produto, das mais perigosas para as menos.

CVE-2025-48868HIGHHorilla vulnerable to authenticated RCE via eval() in project_bulk_archiveEPSS 2.5%CVE-2026-24036MEDIUMHorilla Exposes Unpublished Job Disclosures through Unauthenticated APIEPSS 0.5%CVE-2026-24038HIGHHorilla HR has 2FA Bypass through its OTP Handling LogicEPSS 0.5%CVE-2026-24010HIGHHorilla has HTML Injection Issue that, with Phishing, Leads to Account TakeoverEPSS 0.5%CVE-2025-48869HIGHHorilla Unauthorized Access to Candidate Resume Files Due to Broken Access ControlEPSS 0.4%CVE-2025-59832CRITICALHorrila Stored XSS Vulnerability via Ticket Comment sectionEPSS 0.4%