NamelessMC vulnerabilities
20 published CVEs name NamelessMC among the affected products.
- 20Published CVEs20 of them scored
- 7Last 12 monthspublished in the last year
- 3Critical8 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-40571
NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization
NamelessMC · Nameless
Medium5.3 - CVE-2026-35447
NamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes
NamelessMC · Nameless
Medium5.3 - CVE-2026-40314
NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization
NamelessMC · Nameless
Medium6.9 - CVE-2026-35443
NamelessMC: Forum reactions bypass the "view own topics only" restriction
NamelessMC · Nameless
Medium5.3 - CVE-2026-34460
NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
NamelessMC · Nameless
Medium5.4 - CVE-2026-33398
Authenticated users can read hidden forum posts through `/forum/get_quotes`
NamelessMC · Nameless
High7.1 - CVE-2026-32250
NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/
NamelessMC · Nameless
Medium4.3 - CVE-2025-54117
NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor
NamelessMC · Nameless
Critical9.1 - CVE-2025-54421
NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component
NamelessMC · Nameless
High7.2 - CVE-2025-54118
NamelessMC allows sensitive information disclosure in member list component
NamelessMC · Nameless
Medium5.3