Skip to content
OpenAdvisories

Product · hubzero

hubzero-cms

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-92984

    HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier

    HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted lin…

    hubzero hubzero-cms
  • High 8.8
    CVE-2026-92970

    HUBzero CMS through 2.2.32 Path Traversal via File Upload

    HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters…

    hubzero hubzero-cms