CVE-2026-24010

Katalog CVE

CVSS 8.0 · High EPSS 0,48%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada horilla. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials. When a victim visits the uploaded file URL, they see an authentic-looking "Session Expired" message prompting them to re-authenticate. All entered credentials are captured and sent to the attacker's server, enabling Account Takeover. Version 1.5.0 patches the issue.

Rincian

Terbit di NVD

22 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-474: Use of Function with Inconsistent Implementations
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-5jfv-gw8w-49h3 exploit · advisory vendor
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 release notes