Read the docs

humhub

Records25All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

humhub records in CISA KEV

No humhub vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Humhub 14 records MEDIUM Files 2 records MEDIUM Calendar 1 record LOW Social Network Kit 1 record LOW

Records

25 records

TI-2022-08676 CVE-2022-24865

Improper access control in humhub

Priority MEDIUM 62

HumHub is an Open Source Enterprise Social Network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0124 Published 2022-04-20 Fixed in 1.10.4, 1.9.4 CWE-200
TI-2017-14097 CVE-2017-20026 · GHSA-m7qr-8cph-5cpw

HumHub Reflected cross site scriting

Priority MEDIUM 60

A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00784 Published 2022-06-09 No fix listed CWE-80
TI-2017-14099 CVE-2017-20028 · GHSA-gvfm-vv3m-pgfr

HumHub privileges management

Priority MEDIUM 44

A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00844 Published 2022-06-09 No fix listed CWE-269
TI-2024-34921 CVE-2024-52043 · GHSA-3q4w-rf2j-fx5x

User enumeration in HubHub

Priority LOW 37

Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00427 Published 2024-11-06 No fix listed CWE-209
TI-2014-07750 CVE-2014-9528 · GHSA-gh98-mr5p-7457

SQL injection vulnerability in the actionIndex function in…

Priority LOW 37

SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL c…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02342 Published 2015-01-06 No fix listed CWE-89
TI-2026-23197 CVE-2026-29052

HumHub Calendar Module: Stored XSS in Event Types

Priority LOW 36

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00186 Published 2026-03-05 Fixed in 1.8.11 CWE-79
TI-2026-63128 CVE-2026-93769

Cross-site scripting in Humhub

Priority LOW 34

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/J…

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00493 Published 2026-09-23 No fix listed CWE-79
TI-2026-23193 CVE-2026-29048

HumHub: XSS in Button component

Priority LOW 30

HumHub is an Open Source Enterprise Social Network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00225 Published 2026-03-06 No fix listed CWE-79
TI-2022-13177 CVE-2022-31133

Cross site scripting in HumHub

Priority LOW 28

HumHub is an Open Source Enterprise Social Network.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00733 Published 2022-07-07 Fixed in 1.11.4 CWE-79
TI-2017-14098 CVE-2017-20027 · GHSA-7pxw-jp74-vp3g

HumHub DOM cross site scriting

Priority LOW 28

A vulnerability was found in HumHub up to 1.0.1 and classified as problematic.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00663 Published 2022-06-09 No fix listed CWE-80
Open these records in search →