Humhub vulnerabilities

Products

• Humhub 19
• Calendar 12
• Cfiles 3
• Files 2

Newest

• humhub community edition HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation CVE-2026-115541 7.2 HighNovember 3, 2026
• humhub HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover CVE-2026-93769 7.2 HighSeptember 23, 2026
• humhub HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason CVE-2026-18430 7.2 HighAugust 19, 2026
• humhub HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering CVE-2026-18756 7.2 HighAugust 19, 2026
• humhub HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation CVE-2026-18526 7.4 HighAugust 19, 2026
• humhub calendar Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter CVE-2026-14827 6.8 MediumJuly 27, 2026
• humhub HumHub Missing Authorization on Remove All Space Members Action CVE-2026-47657 7.1 HighJuly 21, 2026
• humhub HumHub: XSS in Button component CVE-2026-29048 6.9 MediumMarch 6, 2026
• humhub calendar HumHub Calendar Module: Stored XSS in Event Types CVE-2026-29052 6.9 MediumMarch 5, 2026
• humhub calendar Calendar <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc' CVE-2025-14548 6.4 MediumDecember 23, 2025
• humhub cfiles CFiles Unauthorized Folder/ZIP Access in Public Spaces CVE-2025-65963 5.4 MediumNovember 25, 2025
• humhub HumHub is vulnerable to XSS through its Meta Search component CVE-2025-64442 7.1 HighNovember 7, 2025
• humhub files, cfiles +1 more Files: Potential for SQL Injection through File Browse and List Operations CVE-2025-54790 9.2 CriticalAugust 1, 2025
• humhub files, cfiles +1 more Files is Vulnerable to Reflected Self-XSS through its File Move Functionality CVE-2025-54789 5.1 MediumAugust 1, 2025
• humhub User enumeration in HubHub CVE-2024-52043 6.9 MediumNovember 6, 2024
• humhub calendar Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode CVE-2024-2831 8.8 HighMay 2, 2024
• humhub calendar Potential zip path traversal vulnerability in Calendar application prior to version 12.4.07.15 in... CVE-2023-30678 5.1 MediumJuly 6, 2023
• humhub calendar Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access... CVE-2022-33705 3.3 LowJuly 11, 2022
• humhub Cross site scripting in HumHub CVE-2022-31133 5.9 MediumJuly 7, 2022
• humhub HumHub privileges management CVE-2017-20028 5.6 MediumJune 9, 2022
• humhub HumHub DOM cross site scriting CVE-2017-20027 4.3 MediumJune 9, 2022
• humhub HumHub Reflected cross site scriting CVE-2017-20026 4.3 MediumJune 9, 2022
• humhub Improper access control in humhub CVE-2022-24865 6.5 MediumApril 20, 2022
• humhub Authorization Bypass in Space Invite in HumHub CVE-2021-43847 6.5 MediumDecember 20, 2021
• humhub social network kit HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts... CVE-2019-12743 5.3 MediumJuly 29, 2019
• humhub calendar OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2... CVE-2019-11829 7.3 HighJune 30, 2019
• humhub calendar Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615... CVE-2019-11825 6.5 MediumJune 30, 2019
• humhub calendar Information exposure through process environment vulnerability in Synology Calendar before 2.3.3... CVE-2019-11820 5.5 MediumMay 9, 2019
• humhub A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject... CVE-2019-11564 Public exploit 6.1 MediumMay 8, 2019
• humhub calendar Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2... CVE-2018-13299 4.3 MediumApril 1, 2019
• humhub A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in... CVE-2019-9094 6.1 MediumMarch 18, 2019
• humhub A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub... CVE-2019-9093 6.1 MediumMarch 18, 2019
• humhub calendar Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows... CVE-2018-8927 5.4 MediumJune 14, 2018
• humhub calendar Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1... CVE-2018-8915 6.5 MediumMay 10, 2018
• humhub Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta... CVE-2016-1229 5.4 MediumJune 5, 2016
• humhub SQL injection vulnerability in the actionIndex function in protected/modules_core/notification... CVE-2014-9528 Public exploit 7.5 HighJanuary 6, 2015