Vulnerabilidades em flarum
16 resultadosAnálise Vexday
Flarum apresenta 12 vulnerabilidades catalogadas, com 2 classificadas como críticas e nenhuma sob ataque ativo conhecido. A fraqueza dominante é injeção de scripts (CWE-79), padrão em plataformas web, com apenas 1 vulnerabilidade publicada nos últimos 90 dias, indicando risco moderado e evolutivo.
CVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 39.7%CVE-2024-21641MEDIUMFlarum's Logout Route allows open redirectsEPSS 1.1%CVE-2023-27577MEDIUMPath Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarumEPSS 0.9%CVE-2021-21283MEDIUMXSS in Flarum Sticky extension.EPSS 0.8%CVE-2022-41938CRITICALCross site scripting vulnerability with discussion titles in flarumEPSS 0.7%CVE-2023-22487HIGHPost mentions can be used to read any post on the forum without access controlEPSS 0.7%CVE-2023-22489LOWFlarum is missing authorization in discussion repliesEPSS 0.6%CVE-2024-58303HIGHFoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template SettingsEPSS 0.5%CVE-2023-40033HIGHServer-Side Request Forgery via Avatar upload in flarumEPSS 0.5%CVE-2025-27794MEDIUMFlarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie OverwriteEPSS 0.5%CVE-2026-41887MEDIUMFlarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)EPSS 0.4%CVE-2023-22488MEDIUMMissing authorization in FlarumEPSS 0.4%CVE-2024-58302MEDIUMFoF Pretty Mail 1.1.2 Local File Inclusion via Email Template SettingsEPSS 0.3%CVE-2026-39923CRITICALFlarum < 1.8.16 Password Reset Token Expiry Bypass via POST /resetEPSS 0.3%CVE-2026-39924HIGHFlarum < 1.8.16 Session Persistence via Improper Access Token RevocationEPSS 0.2%CVE-2026-30913MEDIUMflarum/nickname: Display name injection in notification emails (autolink & markdown)EPSS 0.2%