CVE-2025-32389highCWE-89

CVE-2025-32389: falha de alta gravidade em NamelessMC Nameless

NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages

Publicada em

Seguir esta CVE+ Monitorar Nameless

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.5%
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure `?param[0]=a&param[1]=b&param[2]=c` utilized by PHP, which is parsed by PHP as `$_GET['param']` being of type array. This issue has been patched in version 2.1.4.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Produtos afetados
NamelessMC · Nameless
CVEs relacionadas — NamelessMC Nameless

No mesmo produto, das mais perigosas para as menos.

CVE-2025-22144CRITICALAccount Takeover in NamelessMCEPSS 0.8%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2025-31118HIGHNamelessMC Has Forum Reply Submission Time Limit BypassEPSS 0.6%CVE-2025-30158HIGHNamelessMC Forum iframe width/height abuse causing UI-based Denial of ServiceEPSS 0.6%CVE-2025-31120MEDIUMNamelessMC Vulnerable to Cookie-Based View Count ManipulationEPSS 0.5%CVE-2025-30357HIGHNamelessMC Forum Topic Deletion Triggered by Unrelated User DeletionEPSS 0.5%