PT-2025-4378 · Unknown · Namelessmc

Hicortab · Published 2025-01-13 · Updated 2025-01-14 · CVE-2025-22142

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NamelessMC versions prior to 2.1.3

Description The issue allows an admin to add an extra field that users can fill out, but users can inject javascript code into this field. This code is activated when a staffer visits the user's profile on the staff panel, enabling an attacker to execute javascript code on the staffer's computer.

Recommendations For versions prior to 2.1.3, upgrade to version 2.1.3 to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22142

GHSA-9Q22-W64P-G8QM

Affected Products

Namelessmc

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22142.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-9q22-w64p-g8qm · Exploit
• https://osv.dev/vulnerability/CVE-2025-22142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22142 · Security Note
• https://github.com/NamelessMC/Nameless/releases/tag/v2.1.3 · Note
• https://twitter.com/CVEnew/status/1878898575364460659 · Twitter Post
• https://twitter.com/gothburz/status/1879201939772055962 · Twitter Post
• https://t.me/cvedetector/15172 · Telegram Post