CyberRota Analysis
AI-GeneratedHumHub 1.18.4 is vulnerable to a stored cross-site scripting (XSS) flaw that allows a Space administrator to inject malicious HTML/JavaScript into the comment-deletion notification flow. This could lead to unauthorized script execution in the context of the original author’s session, potentially compromising user accounts and data. Organizations using this version of HumHub should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.