Skip to content
OpenAdvisories

Package · npm

nodebb

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.6
    CVE-2024-57041 EPSS 40%

    NodeBB Cross-site scripting (XSS) vulnerability

    A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

    nodebb npm
  • Medium 6.3
    CVE-2024-29316

    Incorrect Access Control in NodeBB

    NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.

    nodebb npm
  • Medium 4.7
    CVE-2023-2850

    Unintentional leakage of private information via cross-origin websocket session hijacking

    NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

    NodeBB NodeBB nodebb npm
  • Medium 4.3
    CVE-2022-3978

    NodeBB abort cross-site request forgery

    A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to…

    nodebb npm
  • Medium 5.0
    CVE-2021-43788 EPSS 26%

    Path traversal in translator module of NobeBB

    Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users…

    NodeBB NodeBB nodebb npm
  • Medium 6.1
    CVE-2015-9286

    Cross-site Scripting in NodeBB

    Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.

    nodebb npm
  • Medium 6.1
    CVE-2015-3296

    NodeBB Cross-site Scripting Vulnerability in Markdown Processing

    Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.

    nodebb nodebb-plugin-markdown npm