CVE-2026-41513: falha de média gravidade em horilla-hr
Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.3%
Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
horilla · horilla-hrCVEs relacionadas — horilla-hr
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63432MEDIUMHorilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server MetadataEPSS 0.4%CVE-2026-96795HIGHHorilla: Authenticated RCE in Horilla List-View ExportEPSS 0.4%CVE-2026-71483HIGHHorilla: Reflected Cross-Site Scripting (XSS) in Employee Filter ViewEPSS 0.3%CVE-2026-86066MEDIUMHorilla attendance approval endpoint is vulnerable to cross-site request forgeryEPSS 0.3%CVE-2026-63431MEDIUMHorilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)EPSS 0.2%