CVE-2025-48869

Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.

• CWE-284

• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-99h5-x29f-727wExploit, Vendor Advisory

Published

Sep 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48863Rejected reason: This CVE id was assigned but later discarde…
• CVE-2025-48864Rejected reason: This CVE id was assigned but later discarde…
• CVE-2025-48865Fabio is an HTTP(S) and TCP router for deploying application…9.1
• CVE-2025-48866ModSecurity is an open source, cross platform web applicatio…7.5
• CVE-2025-48867Horilla is a free and open source Human Resource Management …4.8
• CVE-2025-48868Horilla is a free and open source Human Resource Management …7.2
• CVE-2025-4887A vulnerability, which was classified as problematic, has be…8.8
• CVE-2025-48870Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-48871Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-48872Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-48873Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-48874Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…