PT-2025-17309 · Unknown · Namelessmc

Gyutrange · Published 2025-04-18 · Updated 2025-05-13 · CVE-2025-30158

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions NamelessMC versions 2.1.4 and prior

Description The issue allows an authenticated attacker to perform a UI-based denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This occurs because the forum does not restrict the width and height attributes of iframe elements posted by users.

Recommendations For versions 2.1.4 and prior, update to version 2.2.0 to resolve the issue. As a temporary workaround, consider restricting the use of iframe elements in forum posts to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-30158

GHSA-2PRX-RGR7-HQ5F

Affected Products

Namelessmc

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30158.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5f · Exploit
• https://github.com/NamelessMC/Nameless/commit/caa42a975338a13fbc1658e8c440108f16135643 · Patch
• https://osv.dev/vulnerability/CVE-2025-30158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30158 · Security Note
• https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0 · Note
• https://t.me/cvedetector/23318 · Telegram Post
• https://t.me/latest_high_impact_cve/2158 · Telegram Post
• https://twitter.com/CVEnew/status/1913312935193264362 · Twitter Post
• https://t.me/cvenotify/121964 · Telegram Post
• https://t.me/cvetracker/21929 · Telegram Post