Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
nodebb vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2022-36045
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far ...
Nodebb Nodebb
Nodebb Nodebb 2.0.0
1 Github repository
6.5
CVSSv2
CVE-2020-15149
NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation e...
Nodebb Nodebb
4.3
CVSSv2
CVE-2015-9286
Controllers.outgoing in controllers/index.js in NodeBB prior to 0.7.3 has outgoing XSS.
Nodebb Nodebb
4.3
CVSSv2
CVE-2015-3296
Multiple cross-site scripting (XSS) vulnerabilities in NodeBB prior to 0.7 allow remote malicious users to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
Nodebb Nodebb
NA
CVE-2023-30591
Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated malicious users to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event ...
Nodebb Nodebb
NA
CVE-2022-36076
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadverte...
Nodebb Nodebb
NA
CVE-2023-43187
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows malicious users to execute arbitrary code via crafted XML-RPC requests.
Nodebb Nodebb
NA
CVE-2023-2850
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.
Nodebb Nodebb
4
CVSSv2
CVE-2021-43788
Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgra...
Nodebb Nodebb
NA
CVE-2023-26045
NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user...
Nodebb Nodebb
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
type confusion
CVE-2024-20360
CVE-2021-47559
XXE
CVE-2024-5229
CVE-2021-47543
CVE-2021-47571
SSTI
CVE-2024-4978
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »