CVE-2025-32389highCWE-89

CVE-2025-32389: fallo de gravedad alta en NamelessMC Nameless

NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages

Publicada el

Seguir esta CVE+ Monitorear Nameless

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 0.5%
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure `?param[0]=a&param[1]=b&param[2]=c` utilized by PHP, which is parsed by PHP as `$_GET['param']` being of type array. This issue has been patched in version 2.1.4.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Productos afectados
NamelessMC · Nameless
CVEs relacionadas — NamelessMC Nameless

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-22144CRITICALAccount Takeover in NamelessMCEPSS 0.8%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2025-31118HIGHNamelessMC Has Forum Reply Submission Time Limit BypassEPSS 0.6%CVE-2025-30158HIGHNamelessMC Forum iframe width/height abuse causing UI-based Denial of ServiceEPSS 0.6%CVE-2025-31120MEDIUMNamelessMC Vulnerable to Cookie-Based View Count ManipulationEPSS 0.5%CVE-2025-30357HIGHNamelessMC Forum Topic Deletion Triggered by Unrelated User DeletionEPSS 0.5%