Read the docs
TI-2025-22381 Aliases CVE-2025-31120

NamelessMC Vulnerable to Cookie-Based View Count Manipulation

Priority MEDIUM 63CWE-565Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie (nl-topic-[tid]) (or session variable for guests) to determine if a view should be counted. When a client does not provide the cookie, every page request increments the counter, leading to incorrect view metrics. This issue has been patched in version 2.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00478 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Nameless (NamelessMC): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NamelessMCNamelessbefore 2.2.02.2.0Patch availableCNA
  • Nameless VendorNamelessMC Affected before 2.2.0 Fixed in 2.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*before 2.2.0VulnerableNamelessMC
  • cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·NamelessMC

Remediation

  • Fix · CNA Nameless (NamelessMC) Fixed in 2.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-31120

References

Exploit 1

Patch 1

Other 1

  • TI-2025-16092 Account Takeover in NamelessMC CVSS 4.0CRITICAL 9.0
  • TI-2025-33960 NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor CVSS 3.1CRITICAL 9.1
  • TI-2025-23467 NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages CVSS 4.0HIGH 8.6
  • TI-2025-21195 NamelessMC Has Lack of Length Validation for s Parameter in GET Requests CVSS 3.1HIGH 7.5
  • TI-2022-02614 Session Fixation in namelessmc/nameless CVSS 3.1HIGH 8.2
  • TI-2025-16090 Cross-site Scripting in NamelessMC CVSS 4.0MEDIUM 6.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences