Exposure of NodeBB

Message boards

29

exposure score

150

sites use

0

exploited

6

critical

CVEs

14 results

CVE-2023-30591HIGHNodeBB Pre-Authentication Denial-of-ServiceEPSS 58.7%CVE-2022-46164CRITICALAccount takeover via prototype vulnerabilityEPSS 47.4%CVE-2021-43788MEDIUMPath traversal in translator module of NobeBBEPSS 25.8%CVE-2020-15149CRITICALAccount takeover in NodeBBEPSS 2.4%CVE-2021-43786CRITICALAPI token verification can be bypassedEPSS 2.4%CVE-2022-36045CRITICALAccount takeover via cryptographically weak PRNG in NodeBB ForumEPSS 1.3%CVE-2021-43787CRITICALXSS via prototype pollutionEPSS 1.3%CVE-2023-26045CRITICALNodeBB vulnerable to path traversal and code execution via prototype vulnerabilityEPSS 1.0%CVE-2022-36076HIGHAccount takeover via SSO plugins in NodeBBEPSS 0.6%CVE-2022-3978MEDIUMNodeBB abort cross-site request forgeryEPSS 0.4%CVE-2026-120007MEDIUMNodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uidEPSS 0.3%CVE-2023-2850MEDIUMNodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vEPSS 0.3%CVE-2026-58593HIGHNodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local UserEPSS 0.3%CVE-2026-73038MEDIUMNodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.nameEPSS 0.2%