The flaw originates from an incomplete, context‑agnostic regular‑expression filter in the has_xss() function used by Horilla HRM version 1.4.0. Malicious input can be inserted into the project name field, allowing an attacker to redirect users, execute arbitrary JavaScript, and capture CSRF tokens that may later be used for further exploitation. This constitutes a classic cross‑site scripting vulnerability described by CWE‑79.

Horilla HRM installations running version 1.4.0 are affected. The security issue was addressed in version 1.5.0, so any deployment on 1.5.0 or later is not vulnerable.

The CVSS score of 4.8 categorizes the flaw as moderate, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically need to target users of the HRMS by submitting a crafted project name through the web interface, a common web‑application attack vector.