CVE-2023-43187

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 47.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-27 · updated 2026-06-17
Weakness: CWE-91

Description

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.

Affected products

NodeBB: before 1.18.6 — fixed in 1.18.6

How to fix

Upgrade to a fixed version: NodeBB 1.18.6. Check the vendor advisory for mitigations.

References

https://github.com/jagat-singh-chaudhary/CVE/blob/main/CVE-2023-43187
https://github.com/jagat-singh-chaudhary/CVE/blob/main/CVE-2023-43187

Get alerted when CVE-2023-43187 or the next vulnerability affects your stack