Skip to main content
cve.nowby Sazabi
← npm
npmPackage

nodebb

14 known vulnerabilities (5 critical, 2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 5 critical, 2 high, 5 medium
Registry
npm

Advisories 14

  • NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).

    Affected: through 4.3.0.

  • CVE-2024-57041Medium 4.6

    A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me'…

    Affected: fixed in 3.11.1.

  • CVE-2024-29316Medium 6.3

    NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group…

    Affected: fixed in 3.6.7.

  • CVE-2023-2850Medium 4.7

    NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin.

    Affected: from 3.0.0, fixed in 3.1.3; fixed in 2.8.13.

  • CVE-2023-26045Critical 10.0

    NodeBB vulnerable to path traversal and code execution via prototype vulnerability

    Affected: from 2.5.0, fixed in 2.8.7.

  • CVE-2022-46164Critical 9.4

    Account takeover via prototype vulnerability

    Affected: fixed in 2.6.1.

  • CVE-2022-3978Medium 4.3

    NodeBB abort cross-site request forgery

    Affected: fixed in 2.5.8.

  • Account takeover via SSO plugins in NodeBB

    Affected: fixed in 1.17.2.

  • CVE-2022-36045Critical 9.0

    Account takeover via cryptographically weak PRNG in NodeBB Forum

    Affected: fixed in 1.19.8; from 2.0.0, fixed in 2.0.1.

  • CVE-2021-43788Medium 5.0

    Path traversal in translator module of NobeBB

    Affected: from 1.0.4, fixed in 1.18.5.

  • CVE-2021-43786Critical 9.8

    API token verification can be bypassed

    Affected: from 1.15.0, fixed in 1.18.5.

  • CVE-2021-43787Critical 9.0

    XSS via prototype pollution

    Affected: from 1.15.0, fixed in 1.18.5.

  • Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.

    Affected: fixed in 0.8.2.

  • Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via…

    Affected: fixed in 0.70.