HumHub is vulnerable to XSS through its Meta Search component
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed humhub (humhub): 1.17.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA humhub (humhub) Fixed in 1.17.4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64442
References
More Humhub vulnerabilities
- TI-2022-08676 Improper access control in humhub CVSS 3.1MEDIUM 6.5
- TI-2017-14097 HumHub Reflected cross site scriting CVSS 3.1MEDIUM 6.1
- TI-2017-14099 HumHub privileges management CVSS 3.1CRITICAL 9.8
- TI-2024-34921 User enumeration in HubHub CVSS 4.0MEDIUM 6.9
- TI-2014-07750 SQL injection vulnerability in the actionIndex function in… CVSS 2.0HIGH 7.5
- TI-2019-08643 A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to… CVSS 3.0MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences