CVE-2025-50979: SQL Injection
Published Aug 27, 2025
·Updated
NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads.
Affected Software
3 affected components
nodebb Nodebb
npm/nodebb<=4.3.0
nodebb Nodebb=4.3.0
Event History
Aug 27, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:31 PM
Data Sourced
via GitHub·06:31 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-50979?
CVE-2025-50979 has a high severity due to its potential for enabling SQL injection attacks.
2
How do I fix CVE-2025-50979?
To fix CVE-2025-50979, update NodeBB to a version later than 4.3.0 where this vulnerability is addressed.
3
Who is affected by CVE-2025-50979?
CVE-2025-50979 affects all users of NodeBB version 4.3.0.
4
What types of attacks can be executed due to CVE-2025-50979?
CVE-2025-50979 allows attackers to execute boolean-based blind and PostgreSQL error-based SQL injection attacks.
5
Is authentication required to exploit CVE-2025-50979?
No, CVE-2025-50979 can be exploited by unauthenticated, remote attackers.