Vulnerability Database

296,760

Total vulnerabilities in the database

CVE-2024-57041

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

Published: Jan 24, 2025
Updated: Aug 11, 2025
CVE: CVE-2024-57041
GHSA: GHSA-vqr3-vrrg-f3jh
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
nodebb	-	3.11.1
nodebb / nodebb	3.11.0	3.11.0.x

http://nodebb.com
https://github.com/NodeBB/NodeBB/commit/4e69bff72fd04779064d37e46a43080e6c328adf
https://www.tonysec.com/posts/cve-2024-57041
https://www.tonysec.com/posts/cve-2024-57041/

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo