Vulnerabilities

TI-2025-20573 CVE-2025-27794 · GHSA-hg9j-64wp-m9px

Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

MEDIUM 63

Flarum is open-source forum software.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00501 Published 2025-03-12 Fixed in 1.8.10 CWE-74

TI-2024-14366 CVE-2024-21641 · GHSA-733r-8xcp-w9mr

Flarum's Logout Route allows open redirects

LOW 31

Flarum is open source discussion platform software.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01067 Published 2024-01-05 Fixed in 1.8.5 CWE-601

TI-2023-20923 CVE-2023-40033 · GHSA-67c6-q4j4-hccg

Server-Side Request Forgery via Avatar upload in flarum

LOW 32

Flarum is an open source forum software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00504 Published 2023-08-16 Fixed in 1.8.0 CWE-918

TI-2023-12287 CVE-2023-27577 · GHSA-vhm8-wwrf-3gcw

Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum

LOW 31

flarum is a forum software package for building communities.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00851 Published 2023-03-10 Fixed in 1.7.0 CWE-22

TI-2023-08738 CVE-2023-22489 · GHSA-hph3-hv3c-7725

Flarum is missing authorization in discussion replies

LOW 18

Flarum is a discussion platform for websites.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.0058 Published 2023-01-13 Fixed in 1.6.3 CWE-862

TI-2023-08737 CVE-2023-22488 · GHSA-8gcg-vwmw-rxj4

Missing authorization in Flarum

LOW 30

Flarum is a forum software for building communities.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00416 Published 2023-01-12 Fixed in 1.6.3 CWE-862

TI-2023-08736 CVE-2023-22487 · GHSA-22m9-m3ww-53h3

Post mentions can be used to read any post on the forum without access control

HIGH 67

Flarum is a forum software for building communities.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00685 Published 2023-01-11 Fixed in 1.6.3 CWE-284

TI-2022-20279 CVE-2022-41938 · GHSA-7x4w-j98p-854x

Cross site scripting vulnerability with discussion titles in flarum

MEDIUM 42

Flarum is an open source discussion platform.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00753 Published 2022-11-19 Fixed in 1.6.2 CWE-79

TI-2021-12339 CVE-2021-32671 · GHSA-5qjq-69w6-fg57

XSS vulnerability with translator

HIGH 70

Flarum is a forum software for building communities.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.4 Published 2021-06-07 Fixed in 1.0.2 CWE-79

TI-2019-09878 CVE-2019-13183

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

LOW 39

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00794 Published 2019-07-07 No fix listed CWE-352

TI-2019-08604 CVE-2019-11514 · GHSA-g6w5-439m-jhwv

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.

LOW 36

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01337 Published 2019-04-25 Fixed in 0.1.0-beta.8 CWE-459

TI-2018-13567 CVE-2018-19133 · GHSA-p6m5-x83r-hqmr

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.

LOW 26

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01167 Published 2018-11-09 No fix listed CWE-200

Vulnerabilities

Filters