Vulnerability · Published Apr 18, 2025 · Assigned by GitHub_M

CVE-2025-30357NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

High 7.3

In plain English

A high-severity security flaw in Nameless from NamelessMC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 59.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator deletes the malicious user's account, all their posts (comments) along with the associated topics (by unrelated users) will be marked as deleted. This issue has been patched in version 2.2.0.

Affected products (as reported)

Vendor	Product	Versions
NamelessMC	Nameless	< 2.2.0

Weakness: CWE-706 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H

References

https://github.com/NamelessMC/Nameless/security/advisories/GHSA-22mc-7c9m-gv8h x_refsource_CONFIRM
https://github.com/NamelessMC/Nameless/commit/7040924e27f99aa486c619a5b4ca809051a1ca7f x_refsource_MISC
https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0 x_refsource_MISC