Nodebb

Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.

1. NodeBB XML-RPC Request xmlrpc.php - XML InjectionCVE-2023-43187Nodebb · 47% likely

   CWE-91

2. NodeBB Pre-Authentication Denial-of-ServiceCVE-2023-30591NodeBB, Inc. · CVSS 7.5 · 59% likely

   CWE-241

3. Account takeover via prototype vulnerabilityCVE-2022-46164NodeBB · CVSS 9.4 · 47% likely

   CWE-665

4. Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.CVE-2025-29513Nodebb · CVSS 6.1 · 43% likely

   CWE-79

5. A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.CVE-2024-57041Nodebb · CVSS 4.6 · 40% likely

   CWE-79

6. Path traversal in translator module of NobeBBCVE-2021-43788NodeBB · CVSS 5 · 26% likely

   CWE-22

7. NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unau…CVE-2025-50979Nodebb · CVSS 8.6 · 11% likely

   CWE-89

8. Account takeover in NodeBBCVE-2020-15149NodeBB · CVSS 9.9 · 2.4% likely

   CWE-269

9. API token verification can be bypassedCVE-2021-43786NodeBB · CVSS 9.8 · 2.4% likely

   CWE-287

10. Account takeover via cryptographically weak PRNG in NodeBB ForumCVE-2022-36045NodeBB · CVSS 9 · 1.3% likely

    CWE-338

11. XSS via prototype pollutionCVE-2021-43787NodeBB · CVSS 9 · 1.3% likely

    CWE-79

12. NodeBB vulnerable to path traversal and code execution via prototype vulnerabilityCVE-2023-26045NodeBB · CVSS 10 · 1.0% likely

    CWE-22

13. Account takeover via SSO plugins in NodeBBCVE-2022-36076NodeBB · CVSS 8.8 · 0.6% likely

    CWE-352

14. NodeBB abort cross-site request forgeryCVE-2022-3978Nodebb · CVSS 4.3 · 0.5% likely

    CWE-863

15. NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.CVE-2024-29316Nodebb · CVSS 6.3 · 0.4% likely
16. NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uidCVE-2026-120007NodeBB · CVSS 6.5 · 0.3% likely

    CWE-639

17. NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user inform…CVE-2023-2850NodeBB · CVSS 4.7 · 0.3% likely

    CWE-1385

18. Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable…CVE-2025-29512Nodebb · CVSS 6.1 · 0.3% likely

    CWE-79

19. NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local UserCVE-2026-58593NodeBB · CVSS 7.5 · 0.3% likely

    CWE-345

20. NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.nameCVE-2026-73038NodeBB · CVSS 6.1 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.