CVE-2025-47789

Horilla Open Redirect Vulnerability in Login

Description

Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any arbitrary site, including phishing or malicious domains, which can be used to impersonate Horilla and trick users. Commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 fixes the issue.

References

Link	Tags
https://github.com/horilla-opensource/horilla/security/advisories/GHSA-cqp5-xx4j-r468
https://github.com/horilla-opensource/horilla/commit/1c72404df6888bb23af73c767fdaee5e6679ebd6

Frequently Asked Questions

What is the severity of CVE-2025-47789?: CVE-2025-47789 has been scored as a medium severity vulnerability.
How to fix CVE-2025-47789?: To fix CVE-2025-47789, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-47789 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-47789 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-47789?: CVE-2025-47789 affects horilla-opensource horilla.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.

Description

Category

CWE-601 – URL Redirection to Untrusted Site ('Open Redirect')

References

Frequently Asked Questions