PT-2025-17313 · Unknown · Namelessmc

Yuhano · Published 2025-04-18 · Updated 2025-04-19 · CVE-2025-31120

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions NamelessMC versions 2.1.4 and prior

Description The issue concerns an insecure view count mechanism in the forum page of NamelessMC, a free website software for Minecraft servers. This mechanism relies on a client-side cookie (nl-topic-[tid]) or a session variable for guests to determine if a view should be counted. When a client does not provide the cookie, every page request increments the counter, leading to incorrect view metrics.

Recommendations For versions 2.1.4 and prior, update to version 2.2.0 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2025-31120

GHSA-8JV7-77JW-H646

Affected Products

Namelessmc

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31120.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-8jv7-77jw-h646 · Exploit
• https://github.com/NamelessMC/Nameless/commit/9b112c0beab346a38b6f5a51e7773b38c6fc52e7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-31120 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31120 · Vendor Advisory
• https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0 · Note
• https://twitter.com/VulmonFeeds/status/1913422277871337896 · Twitter Post
• https://t.me/cvedetector/23321 · Telegram Post
• https://t.me/cvetracker/21932 · Telegram Post
• https://twitter.com/CVEnew/status/1913312932160770443 · Twitter Post