CVE-2025-54789Medium· 6.1▾ SunlitFiles is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code exe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed in version 0.16.10.
files < 0.16.10Upgrade past the affected range:
files 0.16.10Connected by shared product, vendor, weakness, or advisory.
CVE-2025-54790Medium· 6.5Files is a module for managing files inside spaces and user profiles
CVE-2026-93769High· 7.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a …
CVE-2026-29052Medium· 6.1The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities
CVE-2026-91130Critical· 9.3Home Assistant is open source home automation software focused on local control and privacy
CVE-2026-68919High· 7.0GoCD is a continuous deliver server
CVE-2026-52741High· 7.5GoCD is a continuous deliver server