PT-2026-45749 · Unknown · Namelessmc

Danhle5402 · CVE-2026-32250 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NamelessMC version 2.2.4

Description A Reflected Cross-Site Scripting (XSS) issue exists where the application reflects user-supplied input into the HTML response without proper sanitization or output encoding. This occurs at the endpoint "/index.php?route=/queries/user/" via the id parameter. An attacker can craft a malicious URL containing JavaScript code that executes in the victim's browser, potentially leading to session hijacking, phishing attacks, or manipulation of page content.

Recommendations Update to version 2.2.5. As a temporary workaround, avoid using the id parameter in the "/index.php?route=/queries/user/" endpoint until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32250

GHSA-343F-C4GF-RXC7

Affected Products

Namelessmc

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32250.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7 · Exploit
• https://osv.dev/vulnerability/CVE-2026-32250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32250 · Security Note
• https://twitter.com/VulmonFeeds/status/2061882514298355818 · Twitter Post
• https://t.me/CVEtracker/55604 · Telegram Post