EUVD-2026-62546

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18430

HumHub 1.18.4's comment-deletion notification flow does not sanitize the administrator-supplied reason, allowing stored XSS when the original author views the notification. A Space admin can inject HTML/JavaScript targeting another user. CVSS 7.2 (HIGH) reflects network access with high privilege...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. XWiki Platform suffers from a cross-site scripting vulnerability that originates from the fact that any user who can create a space can become the administrator of that space in ...