Vulnerabilities

TI-2026-84815 CVE-2026-115541

Stored cross-site scripting in HumHub friendship confirmation dialog

LOW 32

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog.

CVSS 4.0HIGH 7.2 Network Low privileges User interaction EPSS 0.00401 Published 2026-11-03 Fixed in 1.18.7, 1.19.1 CWE-79

TI-2026-63128 CVE-2026-93769

Cross-site scripting in Humhub

LOW 34

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/J…

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00493 Published 2026-09-23 No fix listed CWE-79

TI-2026-15145 CVE-2026-18430

HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason

HIGH 67

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow.

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.00466 Published 2026-08-19 No fix listed CWE-79

TI-2026-15370 CVE-2026-18756

HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering

LOW 34

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow.

CVSS 4.0HIGH 7.2 Network Low privileges User interaction EPSS 0.00467 Published 2026-08-19 No fix listed CWE-79

TI-2026-15201 CVE-2026-18526

HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

LOW 35

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.

CVSS 4.0HIGH 7.4 Network Low privileges User interaction EPSS 0.0046 Published 2026-08-19 No fix listed CWE-79

TI-2026-35165 CVE-2026-47657

HumHub Missing Authorization on Remove All Space Members Action

LOW 31

HumHub is an Open Source Enterprise Social Network.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-21 Fixed in 1.18.3 CWE-862

TI-2026-23193 CVE-2026-29048

HumHub: XSS in Button component

LOW 30

HumHub is an Open Source Enterprise Social Network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00225 Published 2026-03-06 No fix listed CWE-79

TI-2026-23197 CVE-2026-29052

HumHub Calendar Module: Stored XSS in Event Types

LOW 36

The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00186 Published 2026-03-05 Fixed in 1.8.11 CWE-79

TI-2025-40531 CVE-2025-65963

CFiles Unauthorized Folder/ZIP Access in Public Spaces

LOW 24

Files is a module for managing files inside spaces and user profiles.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00193 Published 2025-11-25 Fixed in 0.16.11, 0.17.2 CWE-284

TI-2025-39853 CVE-2025-64442

HumHub is vulnerable to XSS through its Meta Search component

LOW 31

HumHub is an Open Source Enterprise Social Network.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00245 Published 2025-11-07 Fixed in 1.17.4 CWE-79

TI-2025-34545 CVE-2025-54790

Files: Potential for SQL Injection through File Browse and List Operations

MEDIUM 46

Files is a module for managing files inside spaces and user profiles.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00366 Published 2025-08-01 Fixed in 0.16.10 CWE-89

TI-2025-34544 CVE-2025-54789

Files is Vulnerable to Reflected Self-XSS through its File Move Functionality

LOW 23

Files is a module for managing files inside spaces and user profiles.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00325 Published 2025-08-01 Fixed in 0.6.10 CWE-80

TI-2024-34921 CVE-2024-52043 · GHSA-3q4w-rf2j-fx5x

User enumeration in HubHub

LOW 37

Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00427 Published 2024-11-06 No fix listed CWE-209

TI-2022-13177 CVE-2022-31133

Cross site scripting in HumHub

LOW 28

HumHub is an Open Source Enterprise Social Network.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00733 Published 2022-07-07 Fixed in 1.11.4 CWE-79

TI-2017-14099 CVE-2017-20028 · GHSA-gvfm-vv3m-pgfr

HumHub privileges management

MEDIUM 44

A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00844 Published 2022-06-09 No fix listed CWE-269

TI-2017-14098 CVE-2017-20027 · GHSA-7pxw-jp74-vp3g

HumHub DOM cross site scriting

LOW 28

A vulnerability was found in HumHub up to 1.0.1 and classified as problematic.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00663 Published 2022-06-09 No fix listed CWE-80

TI-2017-14097 CVE-2017-20026 · GHSA-m7qr-8cph-5cpw

HumHub Reflected cross site scriting

MEDIUM 60

A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00784 Published 2022-06-09 No fix listed CWE-80

TI-2022-08676 CVE-2022-24865

Improper access control in humhub

MEDIUM 62

HumHub is an Open Source Enterprise Social Network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0124 Published 2022-04-20 Fixed in 1.10.4, 1.9.4 CWE-200

TI-2021-19653 CVE-2021-43847

Authorization Bypass in Space Invite in HumHub

LOW 31

HumHub is an open-source social network kit written in PHP.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01223 Published 2021-12-20 Fixed in 1.10.3, 1.9.3 CWE-285

TI-2019-09532 CVE-2019-12743 · GHSA-r8ch-45q6-53xj

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user…

LOW 27

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI subs…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01504 Published 2019-07-29 No fix listed CWE-203

TI-2019-08643 CVE-2019-11564 · GHSA-m9v5-xxrp-9jfx

A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to…

LOW 32

A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02627 Published 2019-05-08 No fix listed CWE-79

TI-2019-06564 CVE-2019-9094 · GHSA-46v9-f637-4p8c

A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in…

LOW 29

A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00822 Published 2019-03-18 No fix listed CWE-79

TI-2019-06563 CVE-2019-9093 · GHSA-v6f2-wwcf-x463

A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload…

LOW 29

A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00822 Published 2019-03-18 No fix listed CWE-79

TI-2016-01127 CVE-2016-1229 · GHSA-xvvg-vh8c-2f65

Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and…

LOW 27

Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01129 Published 2016-06-05 No fix listed CWE-79

TI-2014-07750 CVE-2014-9528 · GHSA-gh98-mr5p-7457

SQL injection vulnerability in the actionIndex function in…

LOW 37

SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL c…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02342 Published 2015-01-06 No fix listed CWE-89

Vulnerabilities

Filters