CVE-2026-73038 | Medium | 6.1 | 2026-08-13 | NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes… |
CVE-2026-58593 | High | 7.5 | 2026-07-01 | NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature… |
CVE-2021-47746 | High | 7.5 | 2026-01-21 | NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through… |
CVE-2025-50979 | High | 8.6 | 2025-08-27 | NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sani… |
CVE-2025-29513 | Medium | 6.1 | 2025-04-18 | Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator. |
CVE-2025-29512 | Medium | 6.1 | 2025-04-18 | Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP fu… |
CVE-2024-57041 | Medium | 4.6 | 2025-01-24 | A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their prof… |
CVE-2024-29316 | Medium | 6.3 | 2024-03-28 | NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true. |
CVE-2023-30591 | High | 7.5 | 2023-09-29 | Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, w… |
CVE-2023-43187 | Critical | 9.8 | 2023-09-27 | A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitra… |
CVE-2023-2850 | Medium | 4.7 | 2023-07-25 | NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows… |
CVE-2023-26045 | Critical | 10.0 | 2023-07-24 | NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in t… |
CVE-2022-46164 | Critical | 9.4 | 2022-12-05 | NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payl… |
CVE-2022-3978 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulati… |
CVE-2022-36076 | High | 8.8 | 2022-09-02 | NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the cod… |
CVE-2022-36045 | Critical | 9.0 | 2022-08-31 | NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and… |
CVE-2021-43788 | Medium | 5.0 | 2021-11-29 | Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files out… |
CVE-2021-43787 | Critical | 9.0 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user… |
CVE-2021-43786 | Critical | 9.8 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed mast… |
CVE-2020-15156 | Medium | 6.8 | 2020-08-26 | In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on… |
CVE-2020-15149 | Critical | 9.9 | 2020-08-20 | NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a runn… |
CVE-2015-9286 | Medium | 6.1 | 2019-04-30 | Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS. |
CVE-2015-3296 | Medium | 6.1 | 2017-09-21 | Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (… |