TI-2021-12339 CVE-2021-32671 · GHSA-5qjq-69w6-fg57
XSS vulnerability with translator
Priority HIGH 70
Flarum is a forum software for building communities.
flarum
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
flarum records in CISA KEVNo flarum vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Flarum · all components
TI-2023-08736 CVE-2023-22487 · GHSA-22m9-m3ww-53h3
Post mentions can be used to read any post on the forum without access control
Priority HIGH 67
Flarum is a forum software for building communities.
TI-2025-20573 CVE-2025-27794 · GHSA-hg9j-64wp-m9px
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
Priority MEDIUM 63
Flarum is open-source forum software.
TI-2022-20279 CVE-2022-41938 · GHSA-7x4w-j98p-854x
Cross site scripting vulnerability with discussion titles in flarum
Priority MEDIUM 42
Flarum is an open source discussion platform.
TI-2019-09878 CVE-2019-13183
Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.
Priority LOW 39
Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.
TI-2019-08604 CVE-2019-11514 · GHSA-g6w5-439m-jhwv
User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.
Priority LOW 36
User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.
TI-2023-20923 CVE-2023-40033 · GHSA-67c6-q4j4-hccg
Server-Side Request Forgery via Avatar upload in flarum
Priority LOW 32
Flarum is an open source forum software.
TI-2024-14366 CVE-2024-21641 · GHSA-733r-8xcp-w9mr
Flarum's Logout Route allows open redirects
Priority LOW 31
Flarum is open source discussion platform software.
TI-2023-12287 CVE-2023-27577 · GHSA-vhm8-wwrf-3gcw
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum
Priority LOW 31
flarum is a forum software package for building communities.
TI-2023-08737 CVE-2023-22488 · GHSA-8gcg-vwmw-rxj4
Missing authorization in Flarum
Priority LOW 30
Flarum is a forum software for building communities.
TI-2018-13567 CVE-2018-19133 · GHSA-p6m5-x83r-hqmr
In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.
Priority LOW 26
In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.
TI-2023-08738 CVE-2023-22489 · GHSA-hph3-hv3c-7725
Flarum is missing authorization in discussion replies
Priority LOW 18
Flarum is a discussion platform for websites.