CVE-2025-29513: XSS
Published Apr 18, 2025
·Updated
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
Affected Software
2 affected components
nodebb Nodebb<4.0.4
nodebb Nodebb<=4.0.4
Event History
Apr 18, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-29513?
CVE-2025-29513 is classified as a high severity Cross-Site Scripting (XSS) vulnerability.
2
How do I fix CVE-2025-29513?
To mitigate CVE-2025-29513, update NodeBB to version 4.0.5 or later.
3
What software is affected by CVE-2025-29513?
CVE-2025-29513 affects NodeBB versions up to and including 4.0.4.
4
What type of vulnerability is CVE-2025-29513?
CVE-2025-29513 is a Cross-Site Scripting (XSS) vulnerability.
5
Who can exploit CVE-2025-29513?
Remote attackers can exploit CVE-2025-29513 to store arbitrary code via the admin API Access token generator.