Threats affecting pkg:github/HumHub Community Edition

HumHub Community Edition versions prior to 1.18.7 and between 1.19.0 and before 1.19.1 contain a stored cross-site scripting (XSS) vulnerability in the friendship confirmation dialog. An authenticated low-privileged user can inject HTML into their first and last name fields, which is then rendered unsafely in a modal dialog when other users view the profile's Friends section. This allows execution of attacker-controlled markup within the victim's HumHub origin.