What’s Vulnerable › Vulnerabilities

CVE-2025-32389: NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-18 · updated 2026-06-17
• Weakness: CWE-89

Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure `?param[0]=a&param[1]=b&param[2]=c` utilized by PHP, which is parsed by PHP as `$_GET['param']` being of type array. This issue has been patched in version 2.1.4.

Affected products

• NamelessMC Nameless: before 2.1.4 — fixed in 2.1.4

How to fix

Upgrade to a fixed version: NamelessMC Nameless 2.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/NamelessMC/Nameless/commit/02c81c7c45b98fad1ebe3bc085efae18aec4566f
• https://github.com/NamelessMC/Nameless/releases/tag/v2.1.4
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-5984-mhcp-cq2x

Get alerted when CVE-2025-32389 or the next vulnerability affects your stack