Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Sep 23, 2026HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage UsersCVE-2026-93769 · Other software · Humhub · reported by help@fluidattacks.comHigh 7.2
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.
- Product
- Humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 19, 2026HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow.CVE-2026-18430 · Other software · HumHub · reported by help@fluidattacks.comHigh 7.2
HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 19, 2026HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow.CVE-2026-18756 · Other software · HumHub · reported by help@fluidattacks.comHigh 7.2
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated non-member into submitting the legitimate membership request form, and cause the server to return JavaScript containing attacker-controlled code.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 19, 2026HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.CVE-2026-18526 · Other software · HumHub · reported by help@fluidattacks.comHigh 7.4
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jul 21, 2026HumHub is an Open Source Enterprise Social Network.CVE-2026-47657 · Other software · humhub · reported by GitHubHigh 7.1
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026HumHub is an Open Source Enterprise Social Network.CVE-2026-29048 · Other software · humhub · reported by GitHubMedium 6.9
HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the context of the user's browser. This issue has been patched in version 1.18.1.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activitiesCVE-2026-29052 · Other software · humhub · reported by GitHubMedium 6.9
The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11.
- Product
- calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Files is a module for managing files inside spaces and user profiles.CVE-2025-65963 · Other software · humhub · reported by GitHubMedium 5.4
Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.
- Product
- cfiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025HumHub is an Open Source Enterprise Social Network.CVE-2025-64442 · Other software · humhub · reported by GitHubHigh 7.1
HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Files is a module for managing files inside spaces and user profiles.CVE-2025-54790 · Other software · humhub · reported by GitHubCritical 9.2
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10.
- Product
- cfiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Files is a module for managing files inside spaces and user profiles.CVE-2025-54789 · Other software · humhub · reported by GitHubMedium 5.1
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
- Product
- cfiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co.CVE-2024-52043 · Other software · HumHub GmbH & Co. KG · reported by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfeMedium 6.9
Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects all released HumHub versions: through 1.16.2.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022HumHub is an Open Source Enterprise Social Network.CVE-2022-31133 · Other software · humhub · reported by GitHubMedium 5.9
HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3.CVE-2017-20028 · Other software · unspecified · reported by VulDBMedium 5.6
A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3. It has been classified as critical. This affects an unknown part. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability was found in HumHub up to 1.0.1 and classified as problematic.CVE-2017-20027 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability was found in HumHub up to 1.0.1 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting (DOM). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic.CVE-2017-20026 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting (Reflected). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- HumHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022HumHub is an Open Source Enterprise Social Network.CVE-2022-24865 · Other software · humhub · reported by GitHubMedium 6.5
HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2021HumHub is an open-source social network kit written in PHP.CVE-2021-43847 · Other software · humhub · reported by GitHubMedium 6.5
HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.
- Product
- humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2019HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) CVE-2019-12743 · Other software · Humhub · reported by MITREMedium 5.3
HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure.
- Product
- Social Network KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2019A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/cCVE-2019-11564 · Other software · Humhub · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request.
- Product
- Humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhumhub.orgexploit-db.com
Mar 21, 2019A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition.CVE-2019-9094 · Other software · Humhub · reported by MITREMedium 6.1
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is echoed back in JavaScript code, which resulted in XSS.
- Product
- Humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition.CVE-2019-9093 · Other software · Humhub · reported by MITREMedium 6.1
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back, which resulted in reflected XSS.
- Product
- Humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2016Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject aCVE-2016-1229 · Other software · Humhub · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2015SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier CVE-2014-9528 · Other software · Humhub · reported by MITREHigh 7.5
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.
- Product
- Humhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.