CVE-2025-54118: medium-severity vulnerability in NamelessMC Nameless
NamelessMC allows sensitive information disclosure in member list component
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Sensitive information disclosure in NamelessMC before 2.2.4 allows unauthenticated remote attacker to gain sensitive information such as absolute path of the source code via list parameter. This vulnerability is fixed in 2.2.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
NamelessMC · NamelessRelated CVEs — NamelessMC Nameless
In the same product, most dangerous first.
CVE-2025-22144CRITICALAccount Takeover in NamelessMCEPSS 0.8%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2025-31118HIGHNamelessMC Has Forum Reply Submission Time Limit BypassEPSS 0.6%CVE-2025-30158HIGHNamelessMC Forum iframe width/height abuse causing UI-based Denial of ServiceEPSS 0.6%CVE-2025-32389HIGHNamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports PagesEPSS 0.5%CVE-2025-31120MEDIUMNamelessMC Vulnerable to Cookie-Based View Count ManipulationEPSS 0.5%