CVE-2025-22144

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when the account is manually validated by a user with admincp.core.emails or admincp.users.edit permissions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.php?route=/forgot_password/&c= and reset the password. As a result an attacker may compromise another users password and take over their account. This issue has been addressed in release version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-610
• CWE-640

• https://github.com/NamelessMC/Nameless/releases/tag/v2.1.3Release Notes
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-p883-7496-x35pExploit, Vendor Advisory
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-p883-7496-x35pExploit, Vendor Advisory

Published

Jan 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22139WeGIA is a web manager for charitable institutions. A Reflec…6.1
• CVE-2025-2214A vulnerability was found in Microweber 2.0.19. It has been …6.1
• CVE-2025-22140WeGIA is a web manager for charitable institutions. A SQL In…8.8
• CVE-2025-22141WeGIA is a web manager for charitable institutions. A SQL In…8.8
• CVE-2025-22142NamelessMC is a free, easy to use & powerful website softwar…5.4
• CVE-2025-22143WeGIA is a web manager for charitable institutions. A Reflec…6.1
• CVE-2025-22145Carbon is an international PHP extension for DateTime. Appli…6.3
• CVE-2025-22146Sentry is a developer-first error tracking and performance m…9.1
• CVE-2025-22149JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implement…2.1
• CVE-2025-2215A vulnerability classified as critical was found in Doufox u…5.1
• CVE-2025-22150Undici is an HTTP/1.1 client. Starting in version 4.5.0 and …6.8
• CVE-2025-22151Strawberry GraphQL is a library for creating GraphQL APIs. S…3.7