CVE-2026-24038 is a high-severity improper authentication vulnerability in Horilla HRMS versions 1.4.0 up to but not including 1.5.0. The flaw lies in the OTP verification logic where an expired OTP returns None, and if the attacker omits the OTP field in their request, the comparison incorrectly succeeds, allowing bypass of two-factor authentication. This enables attackers to access accounts without valid OTPs, potentially compromising administrative accounts and sensitive HR data. The vulnerability does not require user interaction but requires some level of privileges (PR:L). No known exploits are currently reported in the wild. The issue has been fixed in version 1.
CVE-2026-24037 is a medium-severity cross-site scripting (XSS) vulnerability in Horilla, an open-source Human Resource Management System (HRMS), affecting versions 1.4.0 up to but not including 1.5.0. The vulnerability arises from an incomplete and context-agnostic input filtering mechanism in the has_xss() function, which fails to properly neutralize malicious input. Exploitation allows attackers to execute arbitrary JavaScript, redirect users to malicious domains, and steal CSRF tokens, enabling further attacks against administrative users. The issue requires high privileges and user interaction but does not impact availability. The vulnerability has been fixed in version 1.5.
CVE-2026-24036 is a medium severity improper access control vulnerability in Horilla, an open-source Human Resource Management System. Versions 1.4.0 through 1.4.x expose unpublished job postings via an unauthenticated endpoint, leaking draft job titles, descriptions, and application links. This unauthorized access can reveal sensitive internal hiring information and disrupt recruitment processes. The vulnerability does not allow modification of data or system compromise but poses confidentiality risks. It has been fixed in version 1.5.
CVE-2026-24035 is an improper access control vulnerability in Horilla HRMS versions 1.4.0 up to but not including 1.5.0. It allows any authenticated employee to upload documents on behalf of other employees due to insufficient server-side validation of the employee_id parameter during file uploads. This flaw does not require user interaction beyond authentication and does not impact confidentiality or availability but can affect data integrity. The vulnerability has a CVSS score of 4.3 (medium severity) and is fixed in version 1.5.
CVE-2026-24034 is a medium severity vulnerability affecting horilla versions prior to 1.5.0, an open-source Human Resource Management System. The flaw arises from unrestricted file upload during profile photo updates, where neither file extension nor content-type is validated. This allows attackers to upload malicious files that can trigger cross-site scripting (XSS) attacks, potentially compromising user confidentiality and integrity. Exploitation requires low privileges but no user interaction, and the vulnerability does not impact availability. The issue is fixed in version 1.5.0. European organizations using horilla versions below 1.
CVE-2026-24010 is a high-severity file upload vulnerability in horilla versions prior to 1.5.0, an open-source Human Resource Management System. Authenticated attackers can upload malicious HTML files disguised as profile pictures, enabling phishing attacks by presenting fake login pages to users. This allows credential theft and potential account takeover without requiring user interaction beyond visiting the malicious URL. The vulnerability stems from improper neutralization of special elements in output used by downstream components (CWE-74). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. The issue is patched in version 1.5.0.