NodeBB

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.

NodeBB is an open source Node.js based forum software.

NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor.

NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).

Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO mess…

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.

Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.

Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the databas…

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7.

NodeBB is Node.js based forum software.

Nodebb is an open source Node.js based forum software.

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io cal…

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.

Nodebb is an open source Node.js based forum software.

Nodebb is an open source Node.js based forum software.

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.

Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.

NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin.