CVE-2026-115541
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
54/100
Published: 2026-11-03
Modified: 2026-11-12
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Active
S:
X
AT:
Present
VC:
High
VI:
High
VA:
None
Description
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| HumHub | HumHub Community Edition | 0 < 1.18.7 |
| HumHub | HumHub Community Edition | 1.19.0 < 1.19.1 |
| HumHub | HumHub Community Edition | 0 < 1.18.7 |
| HumHub | HumHub Community Edition | 1.19.0 < 1.19.1 |