CVE-2025-31118

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature (view_topic.php) does not implement any spam prevention mechanism. This allows authenticated users to continuously post replies without any time restriction, resulting in an uncontrolled surge of posts that can disrupt normal operations. This issue has been patched in version 2.2.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
NamelessMC	Nameless	< 2.2.0

References

https://github.com/NamelessMC/Nameless/commit/51e9d93aaa28d40f060b807533d22b768abea207Patch
https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0Release Notes
https://github.com/NamelessMC/Nameless/security/advisories/GHSA-jhvp-mwj4-922mExploit, Vendor Advisory
https://github.com/NamelessMC/Nameless/security/advisories/GHSA-jhvp-mwj4-922mExploit, Vendor Advisory

Timeline

Published: Apr 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-311197.6generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-au CVE-2025-31126.5CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user send CVE-2025-311205.3NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mech CVE-2025-311215.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image CVE-2025-311229.0scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by CVE-2025-311238.7Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specific CVE-2025-311245.3Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" whi CVE-2025-311257.5Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only app CVE-2025-311265.3Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the CVE-2025-311275.3Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in CVE-2025-311286.9gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. Thi CVE-2025-311298.8Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. Thi