Read the docs
TI-2025-21663 Aliases CVE-2025-30357

NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

Priority LOW 34CWE-706Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator deletes the malicious user's account, all their posts (comments) along with the associated topics (by unrelated users) will be marked as deleted. This issue has been patched in version 2.2.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Nameless (NamelessMC): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NamelessMCNamelessbefore 2.2.02.2.0Patch availableCNA
  • Nameless VendorNamelessMC Affected before 2.2.0 Fixed in 2.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*before 2.2.0VulnerableNamelessMC
  • cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·NamelessMC

Remediation

  • Fix · CNA Nameless (NamelessMC) Fixed in 2.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-30357

References

Exploit 1

Patch 1

Other 1

  • TI-2025-16092 Account Takeover in NamelessMC CVSS 4.0CRITICAL 9.0
  • TI-2025-33960 NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor CVSS 3.1CRITICAL 9.1
  • TI-2025-23467 NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages CVSS 4.0HIGH 8.6
  • TI-2025-21195 NamelessMC Has Lack of Length Validation for s Parameter in GET Requests CVSS 3.1HIGH 7.5
  • TI-2022-02614 Session Fixation in namelessmc/nameless CVSS 3.1HIGH 8.2
  • TI-2025-16090 Cross-site Scripting in NamelessMC CVSS 4.0MEDIUM 6.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences