Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-92984

HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Hubzero
Products
Hubzero-cms
CVE-2026-92970

HUBzero CMS through 2.2.32 Path Traversal via File Upload

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hubzero
Products
Hubzero-cms