PT-2026-136679

CVE-2026-115541

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 4.0

7.2

High

MetricsAV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions HumHub Community Edition version 1.19.0

Description A stored cross-site scripting issue exists in the friendship confirmation dialog. An authenticated low-privileged member can inject HTML into their first and last name fields. When another authenticated user views the profile and clicks the Friends option, the application uses the jQuery html() function to place the decoded display name into a modal, which executes the attacker-controlled markup within the user's session.

Recommendations Update HumHub Community Edition version 1.19.0 to a newer version that contains a fix for this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Miguel Gómez

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers