What is the CVSS score of CVE-2026-32250?

CVE-2026-32250 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

NamelessMC CVE-2026-32250

EUVD-2026-33925 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 security-advisories@github.com

XSS PHP

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 14:37 vuln.today

DescriptionGitHub Advisory

NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in version 2.2.4 in the id parameter of the endpoint /index.php?route=/queries/user/. The application reflects user-supplied input from the id parameter into the HTML response without proper sanitization or output encoding. An attacker can craft a malicious URL containing JavaScript code. When a victim visits the crafted URL, the injected script executes in the victim's browser within the context of the vulnerable application. This could allow attackers to execute arbitrary JavaScript, potentially leading to session hijacking, phishing attacks, or manipulation of page content. Version 2.2.5 fixes the issue.

AnalysisAI

Reflected XSS in NamelessMC 2.2.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser via the unsanitized id parameter at the /index.php?route=/queries/user/ endpoint. Exploitation requires victim interaction (UI:R per CVSS), making this a social-engineering-dependent attack suited to targeted phishing against Minecraft server administrators or users. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; version 2.2.5 fully resolves the issue.

Technical ContextAI

NamelessMC is open-source, PHP-based website software designed for Minecraft server communities. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant: user-supplied input in the id query parameter of /index.php?route=/queries/user/ is rendered directly into the HTML response without output encoding or sanitization. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-reachable, requires no authentication or elevated privileges, and has low attack complexity, constrained only by the need for victim browser interaction. The scope is unchanged (S:U), indicating the injected script executes within the vulnerable application's own origin. No CPE string was included in the input data.

RemediationAI

Upgrade to NamelessMC version 2.2.5, which is confirmed by the vendor advisory to fix this issue. The advisory is available at https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7. If immediate upgrade is not feasible, a WAF rule blocking script-injection patterns (e.g., angle brackets, javascript: URI schemes, event handler keywords) in the id parameter on the /index.php?route=/queries/user/ endpoint can reduce risk, though overly broad rules may break legitimate numeric or alphanumeric id values. Restricting access to that endpoint to authenticated sessions only would further reduce attack surface by eliminating unauthenticated exploitation, but this is an architectural change with potential functional trade-offs and is not a substitute for patching.