Skip to content
OpenAdvisories

Package · npm

nodebb

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.6
    CVE-2025-50979 EPSS 11%

    NodeBB SQL Injection vulnerability

    NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error…

    nodebb npm
  • High 8.8
    CVE-2022-36076

    Account takeover via SSO plugins in NodeBB

    NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) …

    NodeBB NodeBB nodebb npm