Advisories · Technology
Nameless.
Every CVE that names Nameless among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization
- Nameless
- Broken access control
- CVSS 5.3 Medium
NamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes
- Nameless
- Information disclosure
- CVSS 6.9 Medium
NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization
- Nameless
- Broken access control
- CVSS 5.3 Medium
NamelessMC: Forum reactions bypass the "view own topics only" restriction
- Nameless
- Broken access control
- CVSS 5.4 Medium
NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
- Nameless
- Cross-site request forgery (CSRF)
- CWE-302
- CVSS 7.1 High
Authenticated users can read hidden forum posts through `/forum/get_quotes`
- Nameless
- Broken access control
- CVSS 4.3 Medium
NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/
- Nameless
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor
- Nameless
- Cross-site scripting (XSS)
- CVSS 7.2 High
NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component
- Nameless
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
NamelessMC allows sensitive information disclosure in member list component
- Nameless
- Information disclosure
- CVSS 8.6 High
NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages
- Nameless
- SQL injection
- CVSS 5.3 Medium
NamelessMC Vulnerable to Cookie-Based View Count Manipulation
- Nameless
- CWE-565
- CVSS 7.1 High
NamelessMC Has Forum Reply Submission Time Limit Bypass
- Nameless
- Denial of service
- CVSS 7.3 High
NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion
- Nameless
- CWE-706
- CVSS 7.1 High
NamelessMC Forum iframe width/height abuse causing UI-based Denial of Service
- Nameless
- Denial of service
- CVSS 7.5 High
NamelessMC Has Lack of Length Validation for s Parameter in GET Requests
- Nameless
- CWE-20
- CWE-130
- CVSS 6.3 Medium
Cross-site Scripting in NamelessMC
- Nameless
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Account Takeover in NamelessMC
- Nameless
- CWE-610