Medium severity4.3NVD Advisory· Published Feb 24, 2026· Updated Apr 29, 2026
CVE-2026-3049
CVE-2026-3049
Description
A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.
Affected products
1Patches
1730b5a44ff06Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/horilla-opensource/horilla-crm/commit/730b5a44ff060916780c44a4bdbc8ced70a2cd27nvdPatch
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdThird Party AdvisoryVDB Entry
- github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3nvdRelease Notes
- vuldb.comnvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.