Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the context of the user's browser. This issue has been patched in version 1.18.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-06 | 2 | Disclosure2 |
| 2026-03-10 | 1 | Disclosure1 |
🟠 HumHub, Cross-site Scripting (XSS), #CVE-2026-29048 (Medium) https://dailycve.com/humhub-cross-site-scripting-xss-cve-2026-29048-medium/
Post summary
The text announces a medium‑severity XSS vulnerability in HumHub (CVE‑2026‑29048), but does not provide exploitation details, patch information, or evidence of active use.
CVE-2026-29048 HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. … https://www.cve.org/CVERecord?id=CVE-2026-29048
Post summary
The statement announces CVE‑2026‑29048, a cross‑site scripting flaw in HumHub’s Button component, without providing PoC, exploit, patch, or active exploitation details.
CVE-2026-29048 Stored Cross-Site Scripting Vulnerability in HumHub Enterprise Social Network 1.18.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29048
Post summary
The statement announces a stored XSS flaw in HumHub Enterprise 1.18.0, offering no proof‑of‑concept, exploit code, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | humhub | humhub | 1.18.0 | - | - |