UI-Based Denial of Service Vulnerability in NamelessMC Forum Software
CVE-2025-30158

7.1HIGH

Key Information:

Vendor

NamelessMC

Status
NamelessMC
Vendor
CVE Published:
18 April 2025

What is CVE-2025-30158?

In versions 2.1.4 and earlier, NamelessMC's forum software inadvertently permits users to embed iframe elements with unrestricted width and height attributes within forum topics and comments. This allows an authenticated attacker to disrupt normal user interface functionality by injecting oversized iframes, which can block essential UI elements and significantly hinder user interactions. The issue has been resolved in version 2.2.0.

References

https://github.com/NamelessMC/Nameless/commit/caa42a97533...
https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
https://github.com/NamelessMC/Nameless/security/advisorie...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.