{"id":"CVE-2026-93769","published":"2026-09-23T16:16:48.360","lastModified":"2026-09-23T17:17:20.143","description":"HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://fluidattacks.com/advisories/cali","tags":[]},{"url":"https://github.com/humhub/humhub","tags":[]},{"url":"https://github.com/humhub/humhub/pull/8499","tags":[]}],"exploitRefs":[{"url":"https://github.com/humhub/humhub","tags":[]},{"url":"https://github.com/humhub/humhub/pull/8499","tags":[]}],"hasPoc":true,"ai":null}