What’s Vulnerable › Products

NamelessMC Nameless vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your NamelessMC Nameless version is affected

Latest NamelessMC Nameless vulnerabilities

• CVE-2026-40571 — NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization (CVSS 5.3)
• CVE-2026-40314 — NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization (CVSS 6.9)
• CVE-2026-35447 — NamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes (CVSS 5.3)
• CVE-2026-35443 — NamelessMC: Forum reactions bypass the "view own topics only" restriction (CVSS 5.3)
• CVE-2026-34460 — NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping (CVSS 5.4)
• CVE-2026-33398 — Authenticated users can read hidden forum posts through `/forum/get_quotes` (CVSS 7.1)
• CVE-2026-32250 — NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ (CVSS 4.3)
• CVE-2025-54421 — NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component (CVSS 5.4)
• CVE-2025-54118 — NamelessMC allows sensitive information disclosure in member list component (CVSS 5.3)
• CVE-2025-54117 — NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor (CVSS 5.4)
• CVE-2025-32389 — NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages (CVSS 6.5)
• CVE-2025-31120 — NamelessMC Vulnerable to Cookie-Based View Count Manipulation (CVSS 5.3)
• CVE-2025-31118 — NamelessMC Has Forum Reply Submission Time Limit Bypass (CVSS 7.1)
• CVE-2025-30357 — NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion (CVSS 6.8)
• CVE-2025-30158 — NamelessMC Forum iframe width/height abuse causing UI-based Denial of Service (CVSS 7.1)
• CVE-2025-29784 — NamelessMC Has Lack of Length Validation for s Parameter in GET Requests (CVSS 7.5)
• CVE-2025-22144 — Account Takeover in NamelessMC (CVSS 9.8)
• CVE-2025-22142 — Cross-site Scripting in NamelessMC (CVSS 5.4)
• CVE-2022-2821 — Missing Critical Step in Authentication in namelessmc/nameless (CVSS 7.5)
• CVE-2022-2820 — Session Fixation in namelessmc/nameless (CVSS 8.2)