CVE-2026-71483

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.6.0

Description An issue exists where the search parameter at the '/employee/employee-filter-view' endpoint is reflected via the jQuery .html() method in the employee/templates/employee nav.html file without proper HTML neutralization. This allows an external attacker to deliver a crafted link that executes arbitrary JavaScript in the browser of an authenticated employee or administrator. Successful exploitation can lead to unauthorized access to session data and the ability to perform actions using the victim's application privileges.

Recommendations Update to version 1.6.0.