CVE-2026-24010: Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover
Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials. When a victim visits the uploaded file URL, they see an authentic-looking "Session Expired" message prompting them to re-authenticate. All entered credentials are captured and sent to the attacker's server, enabling Account Takeover. Version 1.5.0 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24010?
CVE-2026-24010 is considered a critical vulnerability due to its potential for account takeover through phishing attacks.
How do I fix CVE-2026-24010?
To mitigate CVE-2026-24010, upgrade to Horilla Human Resource Management System version 1.5.0 or later.
Which versions of Horilla are affected by CVE-2026-24010?
CVE-2026-24010 affects all versions of Horilla Human Resource Management System prior to 1.5.0.
What type of attack does CVE-2026-24010 facilitate?
CVE-2026-24010 facilitates phishing attacks that can lead to account takeover.
Is CVE-2026-24010 a file upload vulnerability?
Yes, CVE-2026-24010 includes a critical file upload vulnerability that allows exploited users to deploy phishing methods.