CVE-2025-29513

MediumCVSS 6.1

Published: 18/04/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

14.77%

96th percentile - higher than 96% of all known CVEs

Summary

Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.

Risk Assessment

An attacker can inject malicious script that executes in administrators' browsers, leading to session theft, configuration changes, or data theft.

Recommendation

Immediately upgrade NodeBB to a version later than 4.0.4 and implement input filtering and output encoding for data entered in the API token generator.

Original NVD description (English source)

Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.