PT-2026-45801 · Unknown · Namelessmc

Huajihd · CVE-2026-35447 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NamelessMC versions prior to 2.2.5

Description The profile page located at 'modules/Core/pages/profile.php' processes wall post submissions and replies before verifying if the viewer is authorized to access the profile. This allows users with the profile.post permission to write wall posts to profiles that are private or have blocked them. Furthermore, the reply mechanism fails to verify that the target wall post belongs to the current profile, which enables attackers to inject replies into wall posts owned by other profiles using a restricted profile URL.

Recommendations Update to version 2.2.5.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-35447

GHSA-C9XJ-RXGW-G2HQ

Affected Products

Namelessmc

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35447.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-c9xj-rxgw-g2hq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35447 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35447 · Vendor Advisory
• https://t.me/CVEtracker/55637 · Telegram Post