PT-2025-39325

CVE-2025-59525

Published

2025-09-24

Updated

2025-09-25

Description by

CVSS 4.0

7.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.4.0

Description Horilla is a Human Resource Management System (HRMS). Improper sanitization within the application allows for Cross-Site Scripting (XSS) through uploaded SVG files and allowed <embed> tags. This can lead to the execution of JavaScript when users view affected content, such as announcements, potentially resulting in administrative account takeover.

Recommendations Update to version 1.4.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Gikyon

Mmo-Kali

Orlandocompc

Vendors

Affected products

Weakness enumeration