Threats affecting pkg:npm/nodebb

4 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.1	EPSS 42%	CVE-2025-29513nodebb · Cross-Site Scripting (XSS) Medium6.1EPSS 42%2025-04-18CVE Database V5CVE-2025-29513 Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator. EPSS 42%Vulnerability CWE-79	CVE Database V5	2025-04-18
Medium	6.1	EPSS 0.3%	CVE-2025-29512nodebb · Cross-Site Scripting (XSS) Medium6.1EPSS 0.3%2025-04-18CVE Database V5CVE-2025-29512 Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the database. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2025-04-18
Medium	4.6	EPSS 39%	CVE-2024-57041nodebb · A Persistent Cross-site Scripting (XSS) Medium4.6EPSS 39%2025-01-24CVE Database V5CVE-2024-57041 A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile. EPSS 39%Vulnerability CWE-79	CVE Database V5	2025-01-24
Medium	6.3	EPSS 0.4%	CVE-2024-29316nodebb Medium6.3EPSS 0.4%2024-03-28CVE Database V5CVE-2024-29316 NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true. EPSS 0.4%Vulnerability	CVE Database V5	2024-03-28

Page 1 of 1