Cross-Site Scripting Vulnerability in NodeBB by NodeBB
CVE-2025-29513

6.1MEDIUM

Key Information:

Vendor

NodeBB

Status
NodeBB
Vendor
CVE Published:
18 April 2025

What is CVE-2025-29513?

A Cross-Site Scripting vulnerability exists in NodeBB versions up to and including 4.0.4, enabling remote attackers to inject arbitrary code through the admin API Access token generator. This security flaw poses risks as it can lead to unauthorized actions being performed in the context of the affected user's session, potentially compromising sensitive information and overall system integrity.

References

https://www.tonysec.com/posts/cve-2025-29513/

EPSS Score

42% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.