CVE-2025-29512
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and earlier allows remote attackers to store arbitrary JavaScript code, potentially rendering the IP blacklist functionality unusable until the malicious content is removed from the database.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or permanently disrupt the IP blocking mechanism, increasing the risk of further attacks and loss of trust.
Recommendation
Immediately upgrade NodeBB to version 4.0.5 or later, remove any suspicious content from the database, and implement input filtering and output encoding.
Original NVD description (English source)
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the database.