CVE-2026-40571Medium 5.3NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization0.2%
CVE-2026-35447Medium 5.3NamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes0.2%
CVE-2026-40314Medium 6.9NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization0.3%
CVE-2026-35443Medium 5.3NamelessMC: Forum reactions bypass the "view own topics only" restriction0.2%
CVE-2026-34460Medium 5.4NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping0.1%
CVE-2026-33398High 7.1Authenticated users can read hidden forum posts through `/forum/get_quotes`0.2%
CVE-2026-32250Medium 4.3NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/0.2%
CVE-2025-54117Critical 9.1NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor0.4%
CVE-2025-54421High 7.2NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component0.4%
CVE-2025-54118Medium 5.3NamelessMC allows sensitive information disclosure in member list component0.4%
CVE-2025-32389High 8.6NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages0.5%
CVE-2025-31120Medium 5.3NamelessMC Vulnerable to Cookie-Based View Count Manipulation0.5%
CVE-2025-31118High 7.1NamelessMC Has Forum Reply Submission Time Limit Bypass0.6%
CVE-2025-30357High 7.3NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion0.5%
CVE-2025-30158High 7.1NamelessMC Forum iframe width/height abuse causing UI-based Denial of Service0.6%
CVE-2025-29784High 7.5NamelessMC Has Lack of Length Validation for s Parameter in GET Requests0.7%
CVE-2025-22142Medium 6.3Cross-site Scripting in NamelessMC0.3%
CVE-2025-22144Critical 9.0Account Takeover in NamelessMC0.8%