by Kastro
Paper/Archive/CVE-2025-54117

CVE-2025-54117

NamelessMC Nameless — NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 32.6.326 × 206.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the dashboard text editor component. This vulnerability is fixed in 2.2.4.

Affected

ProductAffectedFixed inSource
Nameless< 2.2.4–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/NamelessMC/Nameless/security/advisories/GHSA-gp3j-j84w-vqxxrefgithub.com/NamelessMC/Nameless/commit/0e77706b2966dd9f2e30502126d6581ecc001f09