Skip to content
Flarum vulnerabilities
Newest
-
flarum framework, nextcloud flow, vaadin +2 more
Push Endpoint Returns Permissive CORS Headers
CVE-2026-110737
2.3 Low
-
flarum framework
Laravel TokenGuard authentication bypass through non-string API credentials
CVE-2026-114509
Public exploitFix available
9.2 Critical
-
flarum framework
Laravel relationship inclusion can trigger unauthorized data destruction
CVE-2026-114508
Fix available
6.5 Medium
-
flarum framework
Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
CVE-2026-110803
8.7 High
-
flarum extension manager
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API
CVE-2026-112291
6.9 Medium
-
flarum framework
Laravel: XSS in Debug Page Information
CVE-2026-102279
Fix available
3.1 Low
-
cleverbrush deep, framework +1 more
cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
CVE-2026-78654
6.9 Medium
-
flarum framework, sangoma freepbx +1 more
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
CVE-2026-73661
8.6 High
-
flarum framework
Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation
CVE-2026-39924
7.6 High
-
flarum framework
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
CVE-2026-39923
9.2 Critical
-
flarum framework
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
CVE-2026-48019
Public exploitFix available
8.9 High
-
cvmh sticky
Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
CVE-2026-6397
6.4 Medium
-
flarum framework
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
CVE-2026-41887
Fix available
4.9 Medium
-
flarum nicknames
flarum/nickname: Display name injection in notification emails (autolink & markdown)
CVE-2026-30913
Fix available
4.6 Medium
-
flarum framework, vaadin, vaadin vaadin-spreadsheet-flow +2 more
Cross-site scripting in Action caption
CVE-2025-15022
Fix available
4.8 Medium
-
flarum framework, sangoma freepbx +1 more
Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation
CVE-2025-67722
5.7 Medium
-
flarum friendsofflarum pretty mail
FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings
CVE-2024-58303
8.6 High
-
flarum friendsofflarum pretty mail
FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings
CVE-2024-58302
6.9 Medium
-
sangoma freepbx, flarum framework +1 more
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
CVE-2025-66039
Public exploit
9.3 Critical
-
sangoma freepbx, flarum framework +1 more
FreePBX vulnerable to unauthenticated Denial of Service
CVE-2025-59056
6.6 Medium
-
flarum framework, sangoma freepbx +1 more
FreePBX Post-Authenticated Command Injection
CVE-2025-55211
6.3 Medium
-
vaadin, vaadin vaadin-upload-flow, flarum framework +2 more
Possibility to bypass file upload validation on the server-side
CVE-2025-9467
Fix available
5.3 Medium
-
adianti framework
Adianti Framework deserialization
CVE-2025-3590
5.3 Medium
-
flarum, flarum framework +1 more
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
CVE-2025-27794
Fix available
6.8 Medium
-
flarum framework
Wifi information acquisition vulnerability in Framework Services
CVE-2020-12492
1.0 Low
-
flarum framework
Framework Information Disclosure Vulnerability
CVE-2020-12491
4.8 Medium
-
flarum, flarum framework +1 more
Flarum's Logout Route allows open redirects
CVE-2024-21641
Fix available
6.5 Medium
-
flarum, flarum framework +1 more
Server-Side Request Forgery via Avatar upload in flarum
CVE-2023-40033
Fix available
7.1 High
-
flarum, flarum framework +1 more
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum
CVE-2023-27577
Fix available
6.6 Medium
-
flarum, flarum framework +1 more
Flarum is missing authorization in discussion replies
CVE-2023-22489
Fix available
3.5 Low
-
flarum, flarum framework +1 more
Missing authorization in Flarum
CVE-2023-22488
Fix available
6.8 Medium
-
flarum, flarum framework +1 more
Post mentions can be used to read any post on the forum without access control
CVE-2023-22487
Fix available
7.7 High
-
flarum, flarum framework +1 more
Cross site scripting vulnerability with discussion titles in flarum
CVE-2022-41938
Fix available
9.0 Critical
-
flarum framework, totaljs total.js +1 more
Code injection in total.js
CVE-2021-32831
Fix available
7.5 High
-
flarum core, flarum +1 more
XSS vulnerability with translator
CVE-2021-32671
Fix available
EPSS 40.0%
10.0 Critical
-
flarum framework
Laravel has a File Validation Bypass
CVE-2025-27515
Public exploitFix available
6.9 Medium
-
flarum framework, debian linux +1 more
Laravel allows environment manipulation via query string
CVE-2024-52301
Public exploitFix available
EPSS 44.8%
8.7 High
-
flarum framework
Blade `@parent` Exploitation Leading To Possible XSS in Laravel
CVE-2021-43808
Fix available
5.3 Medium
-
flarum sticky
XSS in Flarum Sticky extension.
CVE-2021-21283
Fix available
5.4 Medium
-
flarum framework, laravel +1 more
Query Binding Exploitation in Laravel
CVE-2021-21263
Fix available
7.2 High
-
flarum
Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.
CVE-2019-13183
8.8 High
-
flarum
Flarum mishandles invalidation of user email tokens
CVE-2019-11514
Fix available
7.5 High
-
flarum
Flarum Core Leaks PII
CVE-2018-19133
5.3 Medium
-
graniteds, flarum framework +1 more
The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code control
CVE-2017-3200
8.1 High
-
graniteds, flarum framework +1 more
GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization
CVE-2017-3199
8.1 High