CVE-2025-32389 HIGH

CVE-2025-32389: NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages

Vendor Namelessmc
Product Nameless
Weakness CWE-89 · SQLi
Published April 18, 2025
Last update April 18, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure `?param[0]=a&param[1]=b&param[2]=c` utilized by PHP, which is parsed by PHP as `$_GET['param']` being of type array. This issue has been patched in version 2.1.4.

Key dates

02Disclosure timeline

April 18, 2025 CVE published
April 18, 2025 Record updated