CVE-2025-30158

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements inside forum topics/comments/feed with no restriction on the iframe's width and height attributes. This allows an authenticated attacker to perform a UI-based denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This issue has been patched in version 2.2.0.

• CWE-400

• https://github.com/NamelessMC/Nameless/commit/caa42a975338a13fbc1658e8c440108f16135643Patch
• https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0Release Notes
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5fExploit, Vendor Advisory
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5fExploit, Vendor Advisory

Published

Apr 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30151Shopware is an open commerce platform. It's possible to pass…7.5
• CVE-2025-30152The Syliud PayPal Plugin is the Sylius Core Team’s plugin fo…6.5
• CVE-2025-30153kin-openapi is a Go project for handling OpenAPI files. Prio…7.5
• CVE-2025-30154reviewdog/action-setup is a GitHub action that installs revi…8.6
• CVE-2025-30155Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2025-30157Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2025-30159Kirby is an open-source content management system. A vulnera…9.1
• CVE-2025-3016A vulnerability classified as problematic was found in Open …6.5
• CVE-2025-30160Redlib is an alternative private front-end to Reddit. A vuln…7.5
• CVE-2025-30161OpenEMR is a free and open source electronic health records …5.4
• CVE-2025-30162Cilium is a networking, observability, and security solution…4.3
• CVE-2025-30163Cilium is a networking, observability, and security solution…4.7