Humhub

This hub aggregates every CVE we track for Humhub, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 13 most recently published vulnerabilities affecting Humhub.

• CVE-2025-64442HumHub is vulnerable to XSS through its Meta Search component6.1Nov 7, 2025
• CVE-2024-52043User enumeration in HubHub5.3Nov 6, 2024
• CVE-2022-31133Cross site scripting in HumHub5.9Jul 7, 2022
• CVE-2017-20028HumHub privileges management5.6Jun 9, 2022
• CVE-2017-20027HumHub DOM cross site scriting4.3Jun 9, 2022
• CVE-2017-20026HumHub Reflected cross site scriting4.3Jun 9, 2022
• CVE-2022-24865Improper access control in humhub6.5Apr 20, 2022
• CVE-2021-43847Authorization Bypass in Space Invite in HumHub6.5Dec 20, 2021
• CVE-2019-11564A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index....6.1May 8, 2019
• CVE-2019-9094A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is ec...6.1Mar 18, 2019
• CVE-2019-9093A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename p...6.1Mar 18, 2019
• CVE-2016-1229Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspe...5.4Jun 5, 2016
• CVE-2014-9528SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to ...7.5Jan 6, 2015