CVE-2026-32250 Details
Description
NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in version 2.2.4 in the id parameter of the endpoint `/index.php?route=/queries/user/`. The application reflects user-supplied input from the id parameter into the HTML response without proper sanitization or output encoding. An attacker can craft a malicious URL containing JavaScript code. When a victim visits the crafted URL, the injected script executes in the victim's browser within the context of the vulnerable application. This could allow attackers to execute arbitrary JavaScript, potentially leading to session hijacking, phishing attacks, or manipulation of page content. Version 2.2.5 fixes the issue.
A reflected cross-site scripting vulnerability has been identified in NamelessMC version 2.2.4. The issue arises in the 'id' parameter of the '/index.php?route=/queries/user/' endpoint, where user-supplied input is reflected in the HTML response without adequate sanitization or output encoding. This allows attackers to craft malicious URLs containing JavaScript, which, when accessed by victims, executes in their browsers within the context of the vulnerable application. Such exploitation could lead to session hijacking, phishing attacks, or manipulation of page content. The vulnerability has been patched in version 2.2.5.
Users can upgrade to NamelessMC version 2.2.5 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 2, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NamelessMC | 2.2.4 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |