Horilla HR CVE-2026-71483

Exploitation requires a victim who is already an authenticated Horilla employee or administrator to click an attacker-crafted link and load /employee/employee-filter-view (the employee filter view); the search parameter is reflected unescaped through jQuery .html() in employee/templates/employee_nav.html. The attacker themselves needs no account (PR:N), but the flaw is limited by mandatory user interaction (UI:A/UI:R) - a valid, active victim session must reach the vulnerable view - and by the product being pre-1.6.0. There is no default-configuration unauthenticated impact; the payload only executes in the browser of the tricked, logged-in user.

This is a reflected cross-site scripting flaw (CWE-79) confirmed by the vendor's GitHub Security Advisory (GHSA-rw86-x8hq-xgwh) and the one-line fix commit (jQuery .html() → .text() in employee_nav.html). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) correctly captures that the attacker is unauthenticated (PR:N) and merely crafts/delivers a link, but that the payload only fires when a victim with an active session interacts (UI:A) - i.e. an authenticated employee or admin must open the malicious link and reach the employee filter. No EPSS score, CISA KEV entry, or public exploit code is present in the input, so the correct status is: no public exploit identified at time of analysis. The 8.5 score is driven by VC:H/VI:H, which is arguably overstated for reflected XSS - real-world impact is theft of browser-visible session data and actions bound to the victim's privileges (classic CVSS 3.1 ~6.1 with C:L/I:L, S:C, UI:R), not full system confidentiality/integrity compromise. Net: a genuine but interaction-gated, targeted-phishing-style issue in a niche product - moderate priority, not a mass-exploitation threat, and no evidence of active exploitation.

An attacker crafts a URL for /employee/employee-filter-view whose search parameter contains a malicious script payload and phishes it to a logged-in Horilla user. When the victim opens the link and reaches the employee filter, the value is reflected via jQuery .html() and executes in their session, letting the attacker read session-visible data or perform actions as that employee/administrator. No public proof-of-concept is referenced in the available data.