EUVD-2026-33982Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionGitHub Advisory
NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to write wall posts to private or blocking profiles. Additionally, the reply branch does not verify that the target wall post belongs to the current profile, enabling attackers to inject replies into arbitrary wall posts owned by other profiles via a restricted profile URL. This is patched in version 2.2.5.
AnalysisAI
Authorization bypass in NamelessMC 2.2.4's profile wall system allows low-privileged authenticated users to post to private or blocking profiles, and to inject replies into wall posts belonging to arbitrary profiles they would otherwise be restricted from accessing. The profile.php module processes wall post submissions before performing the visibility and block-list authorization checks, meaning the write completes before any rejection occurs. A second independent flaw in the reply branch skips verification that the target wall post belongs to the profile being accessed, enabling cross-profile reply injection via a restricted profile URL. No public exploit code has been identified and this is not listed in CISA KEV, but a patch is available in version 2.2.5.
Technical ContextAI
NamelessMC is a PHP-based website platform designed for Minecraft server communities. The vulnerability resides in modules/Core/pages/profile.php, which handles profile wall post submissions and replies. The root cause is an improper execution sequence: the application processes and persists wall post data before evaluating whether the submitting user is authorized to interact with the target profile. The CWE listed is CWE-201 (Exposure of Sensitive Information Through Sent Data), though the actual root cause more closely resembles CWE-863 (Incorrect Authorization) - the authorization gate exists but is evaluated after the write operation, not before. A secondary flaw in the reply branch omits cross-profile ownership validation entirely, allowing a reply to be anchored to any wall post across the platform, regardless of profile scope. The affected CPE is cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*, with version 2.2.4 confirmed as vulnerable by the GitHub Security Advisory GHSA-c9xj-rxgw-g2hq.
RemediationAI
Upgrade to NamelessMC version 2.2.5, which is confirmed as the patched release per the GitHub Security Advisory GHSA-c9xj-rxgw-g2hq at https://github.com/NamelessMC/Nameless/security/advisories/GHSA-c9xj-rxgw-g2hq. If an immediate upgrade is not possible, the most targeted compensating control is to revoke the profile.post permission from untrusted user groups through the NamelessMC permissions system, which eliminates the attack surface entirely but also disables legitimate wall posting for those groups. Alternatively, administrators can temporarily disable the wall post feature in the Core module configuration, which carries the trade-off of removing all profile wall functionality platform-wide. There is no safe network-layer mitigation since the attack originates from authenticated users with a legitimate permission, making WAF or firewall rules ineffective without also blocking legitimate requests.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today