CVE-2025-31120 NamelessMC Vulnerable to Cookie-Based View Count Manipulation

What is CVE-2025-31120?

CVE-2025-31120 is a medium-severity vulnerability in NamelessMC Nameless, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie (nl-topic-[tid]) (or session variable for guests) to determine if a view should be counted. When a client does not provide the cookie, every page request increments the counter, leading to incorrect view metrics. This issue has been patched in version 2.2.0.

Weakness: CWE-565

Which versions are affected by CVE-2025-31120?

It affects 1 product.

Products include Namelessmc Nameless.

How do I fix CVE-2025-31120?

No fix has been published for CVE-2025-31120 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-31120 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-31120 exists.

Other vulnerabilities in NamelessMC Nameless

• CVE-2022-2821 Missing Critical Step in Authentication in namelessmc/nameless Critical 9.8
• CVE-2025-54117 NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor Critical 9.1
• CVE-2025-22144 Account Takeover in NamelessMC Critical 9.0
• CVE-2025-32389 NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages High 8.6
• CVE-2025-29784 NamelessMC Has Lack of Length Validation for s Parameter in GET Requests High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8jv7-77jw-h646.