NodeBB Elevation of Privilege Vulnerability

NodeBB is a forum system built using Node.js a web application platform built on top of Google's V8 JavaScript engine by the Design Create Play team. A security vulnerability exists in the authentication logic in NodeBB versions 1.12.2 and later fixed in version 1.14.3. An attacker can exploit th...

CVE-2020-15149 Account takeover in NodeBB

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an...

CVE-2020-15149

NodeBB is affected by CVE-2020-15149 where a bug in the validation logic introduced in 1.12.2 allows changing the password of any user via a crafted socket.io call, enabling privilege escalation/account takeover on running forums. The vulnerability affects NodeBB versions up to 1.14.2 (vulnerable...

Information Disclosure

nodebb is vulnerable to information disclosure. The topics that have been deleted are hidden for moderators but not for an administrator...

Cross-Site Scripting (XSS)

nodebb is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the URL...

Cross-site Scripting (XSS)

nodebb is vulnerable to cross-site scripting XSS. The attack exists because it does not have basic protection from XSS and relies on the plugins to perform sanitization of all the parsed content, allowing an attacker to inject malicious script if any of the plugins get disabled...

Cross-Site Scripting (XSS)

nodeBB is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via Controllers.outgoing in controllers/index.js...

GHSA-72FV-QGJ6-2W2P Cross-site Scripting in NodeBB

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...

Cross-site Scripting in NodeBB

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...

CVE-2015-9286

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...

Cross site scripting

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...

CVE-2015-9286

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...

CVE-2015-9286

NodeBB

Cross-Site Scripting (XSS)

The NodeBB forum software is vulnerable to cross-site scriptingXSS. The flag pages description did not properly validate data as text. An attacker could have introduced code injection through the description field...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript: or 2 data: URLs...

CVE-2015-3296

Multiple cross-site scripting XSS vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript: or 2 data: URLs...

CVE-2015-3296

Multiple cross-site scripting XSS vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript: or 2 data: URLs...

CVE-2015-3296

CVE-2015-3296: NodeBB before 0.7 is affected by cross-site scripting in its Markdown processing, allowing remote attackers to inject arbitrary script via javascript: or data: URLs. The vulnerability is tied to insufficient input filtering in the Markdown/html rendering path (markdown-it-based) in...

Script Injection

nodebb is vulnerable to script injection. It does not properly escape translation tokens in topic titles, descriptions, profile about areas, and post content, thereby allowing malicious users to inject scripts...

Ubiquiti Inc.: Stored XSS / Bypassing .htaccess protection in http://nodebb.ubnt.com/

Hello, While I was looking at your renewn SSL certificated, I have noticed the following link : http://nodebb.ubnt.com/ I have seen that this link was protected by htaccess password, but I have decided to run a nmap scan. By running the following : sudo nmap -sSV -p- 104.131.159.88 -oA stageph -T...