Approved changes feed: RSS · Atom
cpe:2.3:a:humhub:humhub:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Humhub (207df78f-b45f-5aa6-92d9-43f6e5adcae3) |
|---|---|
| Product | Humhub (b59ff62f-0863-5fcb-b1d3-5eb2527f120a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:bitbucket/jasoncain/humhub |
purl2cpe | 2026-06-01 10:15:38.303484 |
pkg:github/humhub/humhub |
purl2cpe | 2026-06-01 10:15:38.303486 |
pkg:rpm/opensuse/humhub |
purl2cpe | 2026-06-01 10:15:38.303487 |
pkg:sourceforge/humhub |
purl2cpe | 2026-06-01 10:15:38.303488 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-47657 |
vulnerable | 2026-07-29 00:55:00.331768 |
HumHub Missing Authorization on Remove All Space Members Action
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.
Published: 2026-07-21T17:50:08.427Z
Updated: 2026-07-21T18:36:42.028Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29048 |
vulnerable | 2026-06-08 07:55:16.031649 |
HumHub: XSS in Button component
HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the context of the user's browser. This issue has been patched in version 1.18.1.
Published: 2026-03-06T06:59:42.084Z
Updated: 2026-03-09T19:56:13.803Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64442 |
vulnerable | 2026-06-08 07:39:19.668951 |
HumHub is vulnerable to XSS through its Meta Search component
HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.
Published: 2025-11-07T20:28:20.962Z
Updated: 2025-11-07T20:44:02.514Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52043 |
vulnerable | 2026-06-08 06:52:14.621352 |
User enumeration in HubHub
Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects all released HumHub versions: through 1.16.2.
Published: 2024-11-06T07:51:17.483Z
Updated: 2024-11-06T15:43:32.903Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-31133 |
vulnerable | 2026-06-08 05:43:40.261921 |
Cross site scripting in HumHub
MEDIUM (5.9)
HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
Published: 2022-07-07T17:45:12.000Z
Updated: 2025-04-23T18:04:24.163Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24865 |
vulnerable | 2026-06-08 05:41:44.793529 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43847 |
vulnerable | 2026-06-08 05:36:44.431135 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-20027 |
vulnerable | 2026-06-08 05:09:23.157624 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-20026 |
vulnerable | 2026-06-08 05:09:23.156941 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.