Nodebb - vulnerabilities (CVEs)

23 CVEs in 2 products, 0 in the last 30 days, newest from 2026-08-13.

Products

Nodebb - 22 CVEs
Blog Comments - 1 CVEs

Newest CVEs of Nodebb

CVE-2026-73038 - CVSS 6.1 (medium), 2026-08-13: NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name…
CVE-2026-58593 - CVSS 8.7 (high), 2026-07-01: NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature…
CVE-2021-47746 - CVSS 8.6 (high), 2026-01-21: NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through…
CVE-2025-50979 - CVSS 8.6 (high), 2025-08-27: NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly…
CVE-2025-29513 - CVSS 6.1 (medium), 2025-04-18: Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
CVE-2025-29512 - CVSS 6.1 (medium), 2025-04-18: Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP…
CVE-2024-57041 - CVSS 4.6 (medium), 2025-01-24: A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their…
CVE-2024-29316 - CVSS 6.3 (medium), 2024-03-28: NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.
CVE-2023-30591 - CVSS 7.5 (high), 2023-09-29: Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`,…
CVE-2023-43187 - CVSS 9.8 (critical), 2023-09-27: A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute…
CVE-2023-2850 - CVSS 4.7 (medium), 2023-07-25: NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability…
CVE-2023-26045 - CVSS 10 (critical), 2023-07-24: NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in…
CVE-2022-46164 - CVSS 9.8 (critical), 2022-12-05: NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted…
CVE-2022-3978 - CVSS 4.3 (medium), 2022-11-13: A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The…
CVE-2022-36076 - CVSS 8.8 (high), 2022-09-02: NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the…
CVE-2022-36045 - CVSS 9.8 (critical), 2022-08-31: NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and…
CVE-2021-43787 - CVSS 9 (critical), 2021-11-29: Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious…
CVE-2021-43786 - CVSS 9.8 (critical), 2021-11-29: Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed…
CVE-2021-43788 - CVSS 5 (medium), 2021-11-29: Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files…
CVE-2020-15156 - CVSS 8.1 (high), 2020-08-26: In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf…
CVE-2020-15149 - CVSS 9.9 (critical), 2020-08-20: NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a…
CVE-2015-9286 - CVSS 6.1 (medium), 2019-04-30: Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
CVE-2015-3296 - CVSS 6.1 (medium), 2017-09-21: Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to…