CyberRota Analysis
AI-GeneratedHumHub Community Edition 1.18.4 is vulnerable to a reflected cross-site scripting (XSS) attack in the Space membership-request workflow, allowing an attacker to inject malicious JavaScript through manipulated query-string parameters. This vulnerability can lead to unauthorized actions or data exposure for authenticated users who interact with the compromised membership request form. Organizations using this version of HumHub should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated non-member into submitting the legitimate membership request form, and cause the server to return JavaScript containing attacker-controlled code.