CVE-2026-32250

{"id": "CVE-2026-32250", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32250", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T14:12:41.327091Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "NamelessMC", "product": "Nameless", "versions": [{"status": "affected", "version": "= 2.2.4"}]}]}], "published": "2026-06-02T14:16:50.467", "references": [{"url": "https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7", "source": "security-advisories@github.com"}, {"url": "https://github.com/NamelessMC/Nameless/security/advisories/GHSA-343f-c4gf-rxc7", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in version 2.2.4 in the id parameter of the endpoint `/index.php?route=/queries/user/`. The application reflects user-supplied input from the id parameter into the HTML response without proper sanitization or output encoding. An attacker can craft a malicious URL containing JavaScript code. When a victim visits the crafted URL, the injected script executes in the victim's browser within the context of the vulnerable application. This could allow attackers to execute arbitrary JavaScript, potentially leading to session hijacking, phishing attacks, or manipulation of page content. Version 2.2.5 fixes the issue."}, {"lang": "es", "value": "NamelessMC es un software de sitio web para servidores de Minecraft. Una vulnerabilidad de cross-site scripting reflejado (XSS) fue descubierta en la versi\u00f3n 2.2.4 en el par\u00e1metro id del endpoint '/index.php?route=/queries/user/'. La aplicaci\u00f3n refleja la entrada proporcionada por el usuario del par\u00e1metro id en la respuesta HTML sin una sanitizaci\u00f3n o codificaci\u00f3n de salida adecuadas. Un atacante puede crear una URL maliciosa que contenga c\u00f3digo JavaScript. Cuando una v\u00edctima visita la URL creada, el script inyectado se ejecuta en el navegador de la v\u00edctima dentro del contexto de la aplicaci\u00f3n vulnerable. Esto podr\u00eda permitir a los atacantes ejecutar JavaScript arbitrario, lo que podr\u00eda llevar a secuestro de sesi\u00f3n, ataques de phishing o manipulaci\u00f3n del contenido de la p\u00e1gina. La versi\u00f3n 2.2.5 corrige el problema."}], "lastModified": "2026-07-21T19:10:00.107", "sourceIdentifier": "security-advisories@github.com"}