EUVD-2026-62546

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18430

HumHub 1.18.4's comment-deletion notification flow does not sanitize the administrator-supplied reason, allowing stored XSS when the original author views the notification. A Space admin can inject HTML/JavaScript targeting another user. CVSS 7.2 (HIGH) reflects network access with high privilege...

CVE-2026-18430: Improper Neutralization of Input During Web Page Generation

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2023-35937: Missing Authorization

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can ...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. XWiki Platform suffers from a cross-site scripting vulnerability that originates from the fact that any user who can create a space can become the administrator of that space in ...