CVE-2024-12138

A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimbursement/key_result_current_value_update/create_meetings/create_skills. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-20
• CWE-502

• https://github.com/Sp1d3rL1/horilla-RCEExploit, Third Party Advisory
• https://vuldb.com/?ctiid.286858Permissions Required, VDB Entry
• https://vuldb.com/?id.286858Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.451515Third Party Advisory, VDB Entry

Published

Dec 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12130An “out of bounds read” code execution vulnerability exists …7.8
• CVE-2024-12131The WP Job Portal – A Complete Recruitment System for Compan…4.3
• CVE-2024-12132The WP Job Portal – A Complete Recruitment System for Compan…4.3
• CVE-2024-12133A flaw in libtasn1 causes inefficient handling of specific c…5.3
• CVE-2024-12136Missing Critical Step in Authentication vulnerability in Elf…7.8
• CVE-2024-12137Authentication Bypass by Capture-replay vulnerability in Elf…7.6
• CVE-2024-1214The Easy Social Feed – Social Photos Gallery – Post Feed – L…4.3
• CVE-2024-12140The Elementor Addons AI Addons – 70 Widgets, Premium Templat…4.3
• CVE-2024-12142CWE-200: Exposure of Sensitive Information to an Unauthorize…8.8
• CVE-2024-12143Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2024-12144Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2024-12146Improper Neutralization of Special Elements used in an SQL C…7.5