ROBERT KRUCZEK
← Back to home

CVE-2025-54421

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVSS v3.1: 7.2 (HIGH) Published: August 18, 2025 View on NVD →

Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.4 allows remote authenticated attackers to inject arbitrary web script or HTML via the default_keywords crafted parameter. This vulnerability is fixed in 2.2.4.

Affected Products

Vendor Product Versions Affected
NamelessMC Nameless < 2.2.4 (affected)

CVSS Score & Vector

Base Score: 7.2 (HIGH)
Vector (v3.1):
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References & Advisories