CyberRota Analysis
AI-GeneratedHumHub 1.18.5 contains a stored cross-site scripting (XSS) vulnerability that enables users with the "Manage Users" permission to inject persistent HTML/JavaScript into Profile Field Category titles. This could lead to the execution of malicious scripts in the context of other users, potentially compromising sensitive information or user sessions. Organizations using this version of HumHub should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.