Priority HIGH 77
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0029 · Published 2026-07-01 · No fix listed CWE-290
Priority HIGH 76
NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.1061 · Published 2025-08-27 · No fix listed CWE-89
Priority MEDIUM 60
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.42832 · Published 2025-04-18 · No fix listed CWE-79
Priority MEDIUM 60
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the databas…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00291 · Published 2025-04-18 · No fix listed CWE-79
Priority MEDIUM 54
A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.40107 · Published 2025-01-24 · Fixed in 3.11.1 CWE-79
Priority LOW 28
NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.0043 · Published 2024-03-28 · Fixed in 3.6.7
Priority HIGH 73
Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO mess…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.58692 · Published 2023-09-29 · No fix listed CWE-241
Priority HIGH 82
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.47391 · Published 2023-09-26 · No fix listed CWE-91
Priority LOW 22
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00333 · Published 2023-07-25 · Fixed in 2.8.13, 3.1.3 CWE-1385
Priority MEDIUM 51
NodeBB is Node.js based forum software.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01029 · Published 2023-07-24 · Fixed in 2.8.7 CWE-22
Priority HIGH 79
NodeBB is an open source Node.js based forum software.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.47366 · Published 2022-12-05 · Fixed in 2.6.1 CWE-665
Priority MEDIUM 53
A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00377 · Published 2022-11-13 · Fixed in 2.5.8 CWE-863
Priority HIGH 73
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00576 · Published 2022-09-02 · Fixed in 1.17.2 CWE-352
Priority MEDIUM 46
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01349 · Published 2022-08-31 · Fixed in 1.19.8, 2.0.1 CWE-330
Priority MEDIUM 44
Nodebb is an open source Node.js based forum software.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.25843 · Published 2021-11-29 · Fixed in 1.18.5 CWE-22
Priority MEDIUM 47
Nodebb is an open source Node.js based forum software.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02369 · Published 2021-11-29 · Fixed in 1.18.5 CWE-287
Priority MEDIUM 42
Nodebb is an open source Node.js based forum software.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.01317 · Published 2021-11-29 · Fixed in 1.18.5 CWE-1321
Priority MEDIUM 47
NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io cal…
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.02434 · Published 2020-08-19 · Fixed in 1.14.3 CWE-269
Priority LOW 30
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01357 · Published 2019-04-30 · Fixed in 0.8.2 CWE-79
Priority LOW 30
Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01265 · Published 2017-09-21 · Fixed in 0.70, 5.1.1 CWE-79
THREATIST.IORead the docs