flarum records

13 published records for vendor flarum.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 84.6%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

13 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
52Plan	CVE-2021-32671No exploit	XSS vulnerability with translatorflarum · flarum · CWE-79 Pre-auth XSS	Critical10.0	—	40.0%	Jun 7, 2021
35Monitor	CVE-2019-13183No exploit	Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.flarum · flarum · CWE-352 Pre-auth CSRF	High8.8	—	0.7%	Jul 7, 2019
30Monitor	CVE-2019-11514No exploit	User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.flarum · flarum · CWE-459 Pre-auth	High7.5	—	1.3%	Apr 24, 2019
28Monitor	CVE-2023-40033No exploit	Server-Side Request Forgery via Avatar upload in flarumflarum · flarum · CWE-918 SSRF	High7.1	—	0.5%	Aug 16, 2023
27Monitor	CVE-2025-27794No exploit	Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwriteflarum · flarum · CWE-74 Pre-auth	Medium6.8	—	0.5%	Mar 12, 2025
21Monitor	CVE-2018-19133No exploit	In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.flarum · flarum · CWE-200 Pre-auth Info leak	Medium5.3	—	1.1%	Nov 9, 2018
21Monitor	CVE-2021-21283No exploit	XSS in Flarum Sticky extension.flarum · sticky · CWE-79 XSS	Medium5.4	—	0.7%	Jan 26, 2021
21Monitor	CVE-2022-41938No exploit	Cross site scripting vulnerability with discussion titles in flarumflarum · flarum · CWE-79 XSS	Medium5.4	—	0.7%	Nov 18, 2022
21Monitor	CVE-2023-22488No exploit	Missing authorization in Flarumflarum · flarum · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.4%	Jan 12, 2023
19Monitor	CVE-2023-27577No exploit	Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarumflarum · flarum · CWE-22 Path traversal	Medium4.9	—	0.8%	Mar 10, 2023
18Monitor	CVE-2024-21641Proof of concept	Flarum's Logout Route allows open redirectsflarum · flarum · CWE-601 Pre-auth Open redirect	Medium4.7	—	1.0%	Jan 5, 2024
17Monitor	CVE-2023-22487No exploit	Post mentions can be used to read any post on the forum without access controlflarum · flarum · CWE-284 Broken access control (IDOR)	Medium4.3	—	0.6%	Jan 11, 2023
14Monitor	CVE-2023-22489No exploit	Flarum is missing authorization in discussion repliesflarum · flarum · CWE-862 Broken access control (IDOR)	Low3.5	—	0.5%	Jan 13, 2023

CVE-2021-32671
52Plan
XSS vulnerability with translator
CriticalCVSS 10.0No exploitEPSS 40%
- Pre-auth
- XSS
flarum · flarumJun 7, 2021
CVE-2019-13183
35Monitor
Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
flarum · flarumJul 7, 2019
CVE-2019-11514
30Monitor
User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
flarum · flarumApr 24, 2019
CVE-2023-40033
28Monitor
Server-Side Request Forgery via Avatar upload in flarum
HighCVSS 7.1No exploitEPSS 0%
- SSRF
flarum · flarumAug 16, 2023
CVE-2025-27794
27Monitor
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
MediumCVSS 6.8No exploitEPSS 0%
- Pre-auth
flarum · flarumMar 12, 2025
CVE-2018-19133
21Monitor
In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Info leak
flarum · flarumNov 9, 2018
CVE-2021-21283
21Monitor
XSS in Flarum Sticky extension.
MediumCVSS 5.4No exploitEPSS 0%
- XSS
flarum · stickyJan 26, 2021
CVE-2022-41938
21Monitor
Cross site scripting vulnerability with discussion titles in flarum
MediumCVSS 5.4No exploitEPSS 0%
- XSS
flarum · flarumNov 18, 2022
CVE-2023-22488
21Monitor
Missing authorization in Flarum
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
flarum · flarumJan 12, 2023
CVE-2023-27577
19Monitor
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum
MediumCVSS 4.9No exploitEPSS 0%
- Path traversal
flarum · flarumMar 10, 2023
CVE-2024-21641
18Monitor
Flarum's Logout Route allows open redirects
MediumCVSS 4.7Proof of conceptEPSS 1%
- Pre-auth
- Open redirect
flarum · flarumJan 5, 2024
CVE-2023-22487
17Monitor
Post mentions can be used to read any post on the forum without access control
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
flarum · flarumJan 11, 2023
CVE-2023-22489
14Monitor
Flarum is missing authorization in discussion replies
LowCVSS 3.5No exploitEPSS 0%
- Broken access control (IDOR)
flarum · flarumJan 13, 2023