Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Aug 13, 2026NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes.CVE-2026-73038 · Other software · NodeBB · reported by VulnCheckMedium 5.3
NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor.CVE-2026-58593 · Other software · NodeBB · reported by VulnCheckHigh 8.7
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the sender. In the object mock, attributedTo is used directly as a uid, and actors.assert silently ignores numeric identifiers (filtering them out without re-deriving the uid), so a federated remote actor can set attributedTo to a bare numeric value such as 1 and have the resulting post or private message created with that local uid as author, including the administrator account. This lets a remote attacker forge posts and direct messages attributed to arbitrary local users. Requires the ActivityPub/federation feature to be enabled.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through tCVE-2021-47746 · Other software · NodeBB · reported by VulnCheckHigh 8.6
NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. Attackers with admin access can craft file upload requests with directory traversal to overwrite system files by manipulating the file path parameter.
- Product
- NodeBB Plugin Emoji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).CVE-2025-50979 · Other software · Nodebb · reported by MITREHigh 8.6
NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.CVE-2025-29513 · Other software · Nodebb · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP funCVE-2025-29512 · Other software · Nodebb · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the database.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profiCVE-2024-57041 · Other software · Nodebb · reported by MITREMedium 4.6
A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.CVE-2024-29316 · Other software · Nodebb · reported by MITREMedium 6.3
NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, whCVE-2023-30591 · Other software · NodeBB, Inc. · reported by info@starlabs.sgHigh 7.5
Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrarCVE-2023-43187 · Other software · Nodebb · reported by MITRECritical 9.8
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin.CVE-2023-2850 · Other software · NodeBB · reported by report@snyk.ioMedium 4.7
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2023NodeBB is Node.js based forum software.CVE-2023-26045 · Other software · NodeBB · reported by GitHubCritical 10
NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022NodeBB is an open source Node.js based forum software.CVE-2022-46164 · Other software · NodeBB · reported by GitHubCritical 9.4
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7.CVE-2022-3978 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.CVE-2022-36076 · Other software · NodeBB · reported by GitHubHigh 8.8
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.opera.comgithub.com
Aug 31, 2022NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.CVE-2022-36045 · Other software · NodeBB · reported by GitHubCritical 9
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to. This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the patch sets listed above will fully patch the vulnerability.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2021Nodebb is an open source Node.js based forum software.CVE-2021-43788 · Other software · NodeBB · reported by GitHubMedium 5
Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Nov 29, 2021Nodebb is an open source Node.js based forum software.CVE-2021-43787 · Other software · NodeBB · reported by GitHubCritical 9
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Nov 29, 2021Nodebb is an open source Node.js based forum software.CVE-2021-43786 · Other software · NodeBB · reported by GitHubCritical 9.8
Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Aug 26, 2020In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on CVE-2020-15156 · Other software · psychobunny · reported by GitHubMedium 6.8
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
- Product
- nodebb-plugin-blog-comments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2020NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a runniCVE-2020-15149 · Other software · NodeBB · reported by GitHubCritical 9.9
NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 30, 2019Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.CVE-2015-9286 · Other software · Nodebb · reported by MITREMedium 6.1
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2017Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1CVE-2015-3296 · Other software · Nodebb · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
- Product
- Nodebb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.