CVE-2025-29513

A Cross-Site Scripting (XSS) vulnerability exists in NodeBB versions v4.0.4 and before . The flaw allows remote attackers to store arbitrary code in the admin API Access token generator , which could potentially lead to the execution of malicious code. To remediate this, users should update to ve...

PT-2025-3397

Name of the Vulnerable Software and Affected Versions NodeBB version 3.11.0 Description A persistent cross-site scripting XSS issue allows remote attackers to store arbitrary code in the 'about me' section of their profile. This enables attackers to execute malicious scripts on the website...

PT-2023-28726 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB versions prior to 1.18.6 Description: A remote code execution issue in the "xmlrpc.php" endpoint allows attackers to execute arbitrary code via crafted XML-RPC requests. Recommendations: For versions prior to 1.18.6, update to version...