CVE-2025-22142 - CVE House

Back to Database

Status published Medium CVE-2025-22142

Cross-site Scripting in NamelessMC

6.3 CVSS

Vulnerability Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out an additional field and users can inject javascript code into it that would be activated once a staffer visits the user's profile on staff panel. As a result an attacker can execute javascript code on the staffer's computer. This issue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22142

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from NamelessMC

View All →

NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component

NamelessMC allows sensitive information disclosure in member list component

NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor

NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages

NamelessMC Vulnerable to Cookie-Based View Count Manipulation

Affected Vendor

NamelessMC

View all reports →

Affected Software

Nameless

Vulnerable Versions:

<= 2.1.2

Timeline

Official Publish: January 13th, 2025

Last Modified: January 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement