CVE-2026-18756
HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
CVSS score
7.2
EPSS probability
%0.5
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.2
CVE-2026-18430
HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason
H
Patch verifiedEPSS %1
7.4
CVE-2026-18526
HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
H
Patch verifiedEPSS %0
6.5
CVE-2025-54790
SQL injection in Humhub Files
H
Patch status unknownEPSS %0
7.2
CVE-2026-93769
HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover
H
Patch verifiedEPSS %0
6.1
CVE-2025-54789
Vulnerability in Humhub Files
H
Patch verifiedEPSS %0
6.1
CVE-2026-29052
Cross-site scripting in Humhub Calendar
H
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-18756"