Approved changes feed: RSS · Atom
cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Namelessmc (1f1b4cb8-7dd4-5d5a-bd54-095f8bf85c2e) |
|---|---|
| Product | Nameless (55a4ce3b-b1d4-57ff-88ed-56f1e4b93764) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/namelessmc/nameless |
purl2cpe | 2026-06-01 10:11:14.909368 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-40571 |
vulnerable | 2026-06-08 08:01:20.845683 |
NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization
NamelessMC is website software for Minecraft servers. In version 2.2.4, `core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. This means that authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.
Published: 2026-06-02T16:44:14.286Z
Updated: 2026-06-03T13:50:57.992Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40314 |
vulnerable | 2026-06-08 08:01:20.161988 |
NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization
NamelessMC is website software for Minecraft servers. In version 2.2.4,`core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. `modules/Core/queries/reactions.php` allows unauthenticated GET requests for reaction details. This means that unauthenticated visitors can read reaction participants and timestamps for private profile posts and uthenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 fixes the issue.
Published: 2026-06-02T16:08:21.479Z
Updated: 2026-06-02T17:23:37.908Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35447 |
vulnerable | 2026-06-08 07:59:14.010067 |
NamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes
NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to write wall posts to private or blocking profiles. Additionally, the reply branch does not verify that the target wall post belongs to the current profile, enabling attackers to inject replies into arbitrary wall posts owned by other profiles via a restricted profile URL. This is patched in version 2.2.5.
Published: 2026-06-02T16:41:14.984Z
Updated: 2026-06-02T19:13:47.464Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-35443 |
vulnerable | 2026-06-08 07:59:14.007207 |
NamelessMC: Forum reactions bypass the "view own topics only" restriction
NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can view the forum, but it does not re-enforce topic-level `view_other_topics` authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.
Published: 2026-06-02T15:50:06.670Z
Updated: 2026-06-02T18:08:08.554Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34460 |
vulnerable | 2026-06-08 07:59:12.533547 |
NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
MEDIUM (5.4)
NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.
Published: 2026-06-02T15:29:14.648Z
Updated: 2026-06-02T17:35:29.044Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33398 |
vulnerable | 2026-06-08 07:59:09.866073 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32250 |
vulnerable | 2026-06-08 07:57:17.306630 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54421 |
vulnerable | 2026-06-08 07:33:12.579868 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54118 |
vulnerable | 2026-06-08 07:33:11.593373 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-54117 |
vulnerable | 2026-06-08 07:33:11.592965 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32389 |
vulnerable | 2026-06-08 07:18:59.707885 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-31120 |
vulnerable | 2026-06-08 07:17:02.435843 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-31118 |
vulnerable | 2026-06-08 07:17:02.431650 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-30357 |
vulnerable | 2026-06-08 07:16:59.915028 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-30158 |
vulnerable | 2026-06-08 07:16:59.147426 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29784 |
vulnerable | 2026-06-08 07:14:56.586830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22144 |
vulnerable | 2026-06-08 07:10:52.264514 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22142 |
vulnerable | 2026-06-08 07:10:52.261711 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2821 |
vulnerable | 2026-06-08 05:43:36.552618 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2820 |
vulnerable | 2026-06-08 05:43:36.551428 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.