NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out an additional field and users can inject javascript code into it that would be activated once a staffer visits the user's profile on staff panel. As a result an attacker can execute javascript code on the staffer's computer. This issue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/NamelessMC/Nameless/releases/tag/v2.1.3 | Release Notes |
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-9q22-w64p-g8qm | Exploit Vendor Advisory |
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-9q22-w64p-g8qm | Exploit Vendor Advisory |
Configurations
History
13 May 2025, 15:19
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| First Time |
Namelessmc nameless
Namelessmc |
|
| CPE | cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:* | |
| References | () https://github.com/NamelessMC/Nameless/security/advisories/GHSA-9q22-w64p-g8qm - Exploit, Vendor Advisory | |
| References | () https://github.com/NamelessMC/Nameless/releases/tag/v2.1.3 - Release Notes |
13 Jan 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
13 Jan 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-13 20:15
Updated : 2025-05-13 15:19
NVD link : CVE-2025-22142
Mitre link : CVE-2025-22142
JSON object : View
Products Affected
namelessmc
- nameless
CWE
No CWE.