CVE-2015-9286: Nodebb

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.

Affected products

• Nodebb Nodebb: before 0.7.3 (fixed in 0.7.3)

Published 2019-04-30. Last modified 2026-06-17.