Insecure View Count Mechanism in NamelessMC Forum Page
CVE-2025-31120

5.3MEDIUM

Key Information:

Vendor

NamelessMC

Status
NamelessMC
Vendor
CVE Published:
18 April 2025

What is CVE-2025-31120?

NamelessMC, a popular website software for Minecraft servers, has a vulnerability in its forum page code, allowing unauthenticated attackers to artificially inflate view counts. The application utilizes a client-side cookie or session variable to track views, but when these are not provided, it increments the view counter with every page request. This flaw leads to inflated and misleading view metrics, which could impact analytics and user experience. The issue has been addressed and resolved in version 2.2.0 of NamelessMC.

References

https://github.com/NamelessMC/Nameless/commit/9b112c0beab...
https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
https://github.com/NamelessMC/Nameless/security/advisorie...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.