CVE-2025-22142: Cross-site Scripting in NamelessMC
First published: Mon Jan 13 2025(Updated: )
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out an additional field and users can inject javascript code into it that would be activated once a staffer visits the user's profile on staff panel. As a result an attacker can execute javascript code on the staffer's computer. This issue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NamelessMC | <2.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-22142?
CVE-2025-22142 is classified as a moderate severity vulnerability due to the potential for JavaScript injection by users.
How do I fix CVE-2025-22142?
To fix CVE-2025-22142, update to NamelessMC version 2.1.4 or later.
Which versions of NamelessMC are affected by CVE-2025-22142?
CVE-2025-22142 affects NamelessMC versions up to 2.1.3.
What type of vulnerability is identified in CVE-2025-22142?
CVE-2025-22142 is a JavaScript injection vulnerability due to input validation issues.
What impact does CVE-2025-22142 have on users?
CVE-2025-22142 allows attackers to execute arbitrary JavaScript code when an admin views a user's profile, potentially compromising sensitive information.
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/event
- agent/author
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/namelessmc
- canonical/namelessmc