What’s Vulnerable › Vulnerabilities

CVE-2025-30357: NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-18 · updated 2026-06-17
• Weakness: CWE-706

Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator deletes the malicious user's account, all their posts (comments) along with the associated topics (by unrelated users) will be marked as deleted. This issue has been patched in version 2.2.0.

Affected products

• NamelessMC Nameless: before 2.2.0 — fixed in 2.2.0

How to fix

Upgrade to a fixed version: NamelessMC Nameless 2.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/NamelessMC/Nameless/commit/7040924e27f99aa486c619a5b4ca809051a1ca7f
• https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-22mc-7c9m-gv8h

Get alerted when CVE-2025-30357 or the next vulnerability affects your stack