PT-2025-4378
CVE-2025-22142
·
Published
2025-01-13
·
Updated
2025-01-14
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
NamelessMC versions prior to 2.1.3
Description
The issue allows an admin to add an extra field that users can fill out, but users can inject javascript code into this field. This code is activated when a staffer visits the user's profile on the staff panel, enabling an attacker to execute javascript code on the staffer's computer.
Recommendations
For versions prior to 2.1.3, upgrade to version 2.1.3 to resolve the issue.
At the moment, there is no information about other workarounds for this issue.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾