What’s Vulnerable › Vulnerabilities

CVE-2025-31118: NamelessMC Has Forum Reply Submission Time Limit Bypass

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-18 · updated 2026-06-17
• Weakness: CWE-400

Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature (view_topic.php) does not implement any spam prevention mechanism. This allows authenticated users to continuously post replies without any time restriction, resulting in an uncontrolled surge of posts that can disrupt normal operations. This issue has been patched in version 2.2.0.

Affected products

• NamelessMC Nameless: before 2.2.0 — fixed in 2.2.0

How to fix

Upgrade to a fixed version: NamelessMC Nameless 2.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/NamelessMC/Nameless/commit/51e9d93aaa28d40f060b807533d22b768abea207
• https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-jhvp-mwj4-922m
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-jhvp-mwj4-922m

Get alerted when CVE-2025-31118 or the next vulnerability affects your stack