CVE-2025-31120

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-31120

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31120.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-31120

Aliases

GHSA-8jv7-77jw-h646

Published

2025-04-18T15:52:57.791Z

Modified

2026-04-10T05:24:56.240693Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

NamelessMC Vulnerable to Cookie-Based View Count Manipulation

Details

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie (nl-topic-[tid]) (or session variable for guests) to determine if a view should be counted. When a client does not provide the cookie, every page request increments the counter, leading to incorrect view metrics. This issue has been patched in version 2.2.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31120.json",
    "cwe_ids": [
        "CWE-565"
    ]
}

References

Affected packages

Git / github.com/namelessmc/nameless

Affected ranges

Type: GIT
Repo: https://github.com/namelessmc/nameless
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

4726f43c3e637ca6c97a3bc813794311ef523ea6

Affected versions

v2.*

v2.0.0

v2.0.0-pr1

v2.0.0-pr10

v2.0.0-pr11

v2.0.0-pr13

v2.0.0-pr2

v2.0.0-pr3

v2.0.0-pr4

v2.0.0-pr5

v2.0.0-pr6

v2.0.0-pr7

v2.0.0-pr8

v2.0.1

v2.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31120.json"