HumHub

Products

Exploited and recent CVEs

• CVE-2026-115541 High 7.2 HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation 0.4%
• CVE-2026-93769 High 7.2 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover 0.5%
• CVE-2026-18430 High 7.2 HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason 0.5%
• CVE-2026-18756 High 7.2 HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering 0.5%
• CVE-2026-18526 High 7.4 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation 0.5%
• CVE-2026-47657 High 7.1 HumHub Missing Authorization on Remove All Space Members Action 0.4%
• CVE-2026-29048 Medium 6.9 HumHub: XSS in Button component 0.2%
• CVE-2026-29052 Medium 6.9 HumHub Calendar Module: Stored XSS in Event Types 0.2%
• CVE-2025-65963 Medium 5.4 CFiles Unauthorized Folder/ZIP Access in Public Spaces 0.2%
• CVE-2025-64442 High 7.1 HumHub is vulnerable to XSS through its Meta Search component 0.2%
• CVE-2025-54790 Critical 9.2 Files: Potential for SQL Injection through File Browse and List Operations 0.4%
• CVE-2025-54789 Medium 5.1 Files is Vulnerable to Reflected Self-XSS through its File Move Functionality 0.3%
• CVE-2022-31133 Medium 5.9 Cross site scripting in HumHub 0.7%
• CVE-2022-24865 Medium 6.5 Improper access control in humhub 1.2%
• CVE-2021-43847 Medium 6.5 Authorization Bypass in Space Invite in HumHub 1.2%