Unintentional leakage of private information via cross-origin websocket session hijacking
Modified: 7/8/2026
package
pkg:npm/nodebb
Unintentional leakage of private information via cross-origin websocket session hijacking
Modified: 7/8/2026
NodeBB vulnerable to Cross-Site Request Forgery
Modified: 11/8/2023
Cross-site Scripting in NodeBB
Modified: 11/8/2023
NodeBB Cross-site Scripting Vulnerability in Markdown Processing
Modified: 9/10/2026
API token verification can be bypassed in NodeBB
Modified: 7/8/2026
Cryptographically weak PRNG in `utils.generateUUID`
Modified: 11/8/2023
NodeBB vulnerable to path traversal in translator module
Modified: 7/8/2026
Incorrect Access Control in NodeBB
Modified: 11/18/2024
NodeBB vulnerable to account takeover via prototype vulnerability
Modified: 11/8/2023
NodeBB SQL Injection vulnerability
Modified: 8/27/2025
Path traversal and code execution via prototype vulnerability
Modified: 9/10/2026
NodeBB Cross-site scripting (XSS) vulnerability
Modified: 2/7/2025
XSS via prototype pollution in NodeBB
Modified: 7/8/2026
NodeBB account takeover via SSO plugins
Modified: 11/8/2023