【中文导读】该 CVE 涉及跨站脚本、跨站请求伪造（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.