CVE-2019-9094

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-21 · updated 2026-06-17
Weakness: CWE-79

Description

A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is echoed back in JavaScript code, which resulted in XSS.

Affected products

humhub: 1.3.10

References

https://github.com/humhub/humhub/blob/master/protected/humhub/docs/CHANGELOG.md
https://github.com/humhub/humhub/blob/master/protected/humhub/docs/CHANGELOG.md

Get alerted when CVE-2019-9094 or the next vulnerability affects your stack