A high-severity cross-site scripting vulnerability in Horilla HR, fixed in version 1.6.0, permits attackers to hijack administrative or employee sessions through malicious link injection.

This is a reflected cross-site scripting (CWE-79) vulnerability occurring in the search parameter at the /employee/employee-filter-view endpoint. The application fails to neutralize input before reflecting it via jQuery .html(), allowing an unauthenticated attacker to execute arbitrary scripts when an authenticated user accesses the crafted URL.

Successful exploitation allows an attacker to gain unauthorized access to an authenticated user's session, including those with administrative privileges. This can lead to the theft of sensitive HR and CRM data, unauthorized modifications to employee records, or complete account takeover. With a CVSS score of 8.5, this vulnerability represents a significant risk to organizational data integrity and confidentiality.

Immediate Action: Update the Horilla HR software to version 1.6.0 or later immediately to apply the necessary input neutralization patches.

Proactive Monitoring: Monitor web application logs for suspicious URL parameters containing encoded scripts or unusual access patterns originating from external sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS payloads and malicious script injections targeting URL parameters.

Public Exploit Available: No

Given the potential for session hijacking and unauthorized administrative access, this vulnerability should be treated as a high priority. Organizations using Horilla HR must verify their current version and apply the 1.6.0 update immediately. Failure to patch leaves the environment vulnerable to sophisticated credential and data theft campaigns.