Vulnerabilidades em Flarum
16 resultadosAnálise Vexday
Flarum apresenta um perfil de risco reduzido com apenas 2 CVEs catalogadas e nenhuma sob exploração ativa conhecida. Não há vulnerabilidades críticas nem publicações recentes, indicando que a exposição atual é limitada e não demanda ação imediata. A fraqueza identificada (CWE-1336 - definição imprecisa em linguagem natural) é de baixo impacto operacional direto.
CVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 39.7%CVE-2024-21641MEDIUMFlarum's Logout Route allows open redirectsEPSS 1.1%CVE-2023-27577MEDIUMPath Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarumEPSS 0.9%CVE-2021-21283MEDIUMXSS in Flarum Sticky extension.EPSS 0.8%CVE-2022-41938CRITICALCross site scripting vulnerability with discussion titles in flarumEPSS 0.7%CVE-2023-22487HIGHPost mentions can be used to read any post on the forum without access controlEPSS 0.7%CVE-2023-22489LOWFlarum is missing authorization in discussion repliesEPSS 0.6%CVE-2024-58303HIGHFoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template SettingsEPSS 0.5%CVE-2023-40033HIGHServer-Side Request Forgery via Avatar upload in flarumEPSS 0.5%CVE-2025-27794MEDIUMFlarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie OverwriteEPSS 0.5%CVE-2026-41887MEDIUMFlarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)EPSS 0.4%CVE-2023-22488MEDIUMMissing authorization in FlarumEPSS 0.4%CVE-2024-58302MEDIUMFoF Pretty Mail 1.1.2 Local File Inclusion via Email Template SettingsEPSS 0.3%CVE-2026-39923CRITICALFlarum < 1.8.16 Password Reset Token Expiry Bypass via POST /resetEPSS 0.3%CVE-2026-39924HIGHFlarum < 1.8.16 Session Persistence via Improper Access Token RevocationEPSS 0.2%CVE-2026-30913MEDIUMflarum/nickname: Display name injection in notification emails (autolink & markdown)EPSS 0.2%