CVE-2026-32250

NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in version 2.2.4 in the id parameter of the endpoint `/index.php?route=/queries/user/`. The application reflects user-supplied input from the id parameter into the HTML response without proper sanitization or output encoding. An attacker can craft a malicious URL containing JavaScript code. When a victim visits the crafted URL, the injected script executes in the victim's browser within the context of the vulnerable application. This could allow attackers to execute arbitrary JavaScript, potentially leading to session hijacking, phishing attacks, or manipulation of page content. Version 2.2.5 fixes the issue.

• CWE-79

• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7

Published

Jun 2, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32245Tinyauth is an authentication and authorization server. Prio…6.5
• CVE-2026-32246Tinyauth is an authentication and authorization server. Prio…7.1
• CVE-2026-32247Graphiti is a framework for building and querying temporal c…8.1
• CVE-2026-32248Parse Server is an open source backend that can be deployed …9.8
• CVE-2026-32249Vim is an open source, command line text editor. From 9.1.00…5.5
• CVE-2026-3225The LearnPress – WordPress LMS Plugin plugin for WordPress i…4.3
• CVE-2026-32251Tolgee is an open-source localization platform. Prior to 3.1…6.5
• CVE-2026-32252Chartbrew is an open-source web application that can connect…7.7
• CVE-2026-32253Sunshine is a self-hosted game stream host for Moonlight. In…9.8
• CVE-2026-32254Kube-router is a turnkey solution for Kubernetes networking.…7.1
• CVE-2026-32255Kan is an open-source project management tool. In versions 0…8.6
• CVE-2026-32256music-metadata is a metadata parser for audio and video medi…7.5