NamelessMC vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 202511
3. 20267

Newest CVEs

• CVE-2026-40571

  NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization

  NamelessMC · Nameless

  Medium5.3
• CVE-2026-35447

  NamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes

  NamelessMC · Nameless

  Medium5.3
• CVE-2026-40314

  NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization

  NamelessMC · Nameless

  Medium6.9
• CVE-2026-35443

  NamelessMC: Forum reactions bypass the "view own topics only" restriction

  NamelessMC · Nameless

  Medium5.3
• CVE-2026-34460

  NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping

  NamelessMC · Nameless

  Medium5.4
• CVE-2026-33398

  Authenticated users can read hidden forum posts through `/forum/get_quotes`

  NamelessMC · Nameless

  High7.1
• CVE-2026-32250

  NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/

  NamelessMC · Nameless

  Medium4.3
• CVE-2025-54117

  NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor

  NamelessMC · Nameless

  Critical9.1
• CVE-2025-54421

  NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component

  NamelessMC · Nameless

  High7.2
• CVE-2025-54118

  NamelessMC allows sensitive information disclosure in member list component

  NamelessMC · Nameless

  Medium5.3