CVE-2025-54117 | THREATINT

Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the dashboard text editor component. This vulnerability is fixed in 2.2.4.

PUBLISHED Reserved 2025-07-16 | Published 2025-08-18 | Updated 2025-08-18 | Assigner GitHub_M

CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Problem types

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

< 2.2.4

affected

References

github.com/...meless/security/advisories/GHSA-gp3j-j84w-vqxx

github.com/...ommit/0e77706b2966dd9f2e30502126d6581ecc001f09

cve.org (CVE-2025-54117)

nvd.nist.gov (CVE-2025-54117)

Download JSON