Vulnerabilities in HumHub
15 resultsCVE-2022-24865MEDIUMImproper access control in humhubEPSS 1.2%CVE-2021-43847MEDIUMAuthorization Bypass in Space Invite in HumHubEPSS 1.2%CVE-2022-31133MEDIUMCross site scripting in HumHubEPSS 0.7%CVE-2026-93769HIGHHumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeoverEPSS 0.5%CVE-2026-18756HIGHHumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button renderingEPSS 0.5%CVE-2026-18430HIGHHumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reasonEPSS 0.5%CVE-2026-18526HIGHHumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmationEPSS 0.5%CVE-2026-115541HIGHHumHub 1.19.0 - Stored cross-site scripting in friendship confirmationEPSS 0.4%CVE-2025-54790CRITICALFiles: Potential for SQL Injection through File Browse and List OperationsEPSS 0.4%CVE-2026-47657HIGHHumHub Missing Authorization on Remove All Space Members ActionEPSS 0.4%CVE-2025-54789MEDIUMFiles is Vulnerable to Reflected Self-XSS through its File Move FunctionalityEPSS 0.3%CVE-2025-64442HIGHHumHub is vulnerable to XSS through its Meta Search componentEPSS 0.2%CVE-2026-29048MEDIUMHumHub: XSS in Button componentEPSS 0.2%CVE-2025-65963MEDIUMCFiles Unauthorized Folder/ZIP Access in Public SpacesEPSS 0.2%CVE-2026-29052MEDIUMHumHub Calendar Module: Stored XSS in Event TypesEPSS 0.2%