Advisories · Technology
Humhub.
Every CVE that names Humhub among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover
- Humhub
- Cross-site scripting (XSS)
- CVSS 7.2 High
HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason
- HumHub
- Cross-site scripting (XSS)
- CVSS 7.2 High
HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
- HumHub
- Cross-site scripting (XSS)
- CVSS 7.4 High
HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
- HumHub
- Cross-site scripting (XSS)
- CVSS 7.1 High
HumHub Missing Authorization on Remove All Space Members Action
- humhub
- Broken access control
- CVSS 6.9 Medium
HumHub: XSS in Button component
- humhub
- Cross-site scripting (XSS)
- CVSS 7.1 High
HumHub is vulnerable to XSS through its Meta Search component
- humhub
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
User enumeration in HubHub
- HumHub
- Information disclosure
- CVSS 5.9 Medium
Cross site scripting in HumHub
- humhub
- Cross-site scripting (XSS)
- CVSS 5.6 Medium
HumHub privileges management
- HumHub
- Privilege escalation
- CVSS 4.3 Medium
HumHub DOM cross site scriting
- HumHub
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
HumHub Reflected cross site scriting
- HumHub
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Improper access control in humhub
- humhub
- Information disclosure
- CVSS 6.5 Medium
Authorization Bypass in Space Invite in HumHub
- humhub
- Broken access control