{"id":"CVE-2026-115541","published":"2026-11-03T22:19:17.723","lastModified":"2026-11-03T22:19:17.723","description":"HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://fluidattacks.com/advisories/toujours","tags":[]},{"url":"https://github.com/humhub/humhub","tags":[]},{"url":"https://github.com/humhub/humhub/pull/8624","tags":[]},{"url":"https://github.com/humhub/humhub/pull/8625","tags":[]},{"url":"https://github.com/humhub/humhub/releases/tag/v1.18.7","tags":[]},{"url":"https://github.com/humhub/humhub/releases/tag/v1.19.3","tags":[]},{"url":"https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m","tags":[]}],"exploitRefs":[{"url":"https://github.com/humhub/humhub","tags":[]},{"url":"https://github.com/humhub/humhub/pull/8624","tags":[]},{"url":"https://github.com/humhub/humhub/pull/8625","tags":[]},{"url":"https://github.com/humhub/humhub/releases/tag/v1.18.7","tags":[]},{"url":"https://github.com/humhub/humhub/releases/tag/v1.19.3","tags":[]},{"url":"https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m","tags":[]}],"hasPoc":true,"ai":null}