CVE-2026-115541 — Vulnerability intelligence
—
Published:
- CVSS
- 7.2
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.