Yuriy Bakhtin

4 exploits Active since Apr 2022
CVE-2022-24865 WRITEUP MEDIUM WRITEUP
HumHub < 1.9.4 - Unauthorized Data Exposure via Forced Password Change
HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.
CVSS 6.5
CVE-2022-31133 WRITEUP MEDIUM WRITEUP
HumHub < 1.10.5 - Authenticated Stored Cross-Site Scripting in Space Name
HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
CVSS 5.9
CVE-2025-54789 WRITEUP MEDIUM WRITEUP
humhub/files < 0.16.10 - Stored Cross-Site Scripting via File Move Functionality
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
CVSS 6.1
CVE-2025-65963 WRITEUP MEDIUM WRITEUP
Files <0.16.11 & <0.17.2 - Info Disclosure
Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.
CVSS 5.4