CVE-2025-59525

MEDIUM

horilla < 1.4.0 - Stored Cross-Site Scripting via SVG File Upload

Title source: llm
STIX 2.1

Description

Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG (and via allowed <embed>), which can be chained to execute JavaScript whenever users view impacted content (e.g., announcements). This can result in admin account takeover. This issue has been patched in version 1.4.0.

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0027
EPSS Percentile 17.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-434 CWE-79
Status published
Products (1)
horilla/horilla < 1.4.0
Published Sep 24, 2025
Tracked Since Feb 18, 2026