CVE-2025-32389

CVE-2025-32389 concerns NamelessMC prior to 2.1.4, where an SQL injection could be triggered by the square bracket GET parameter syntax (e.g., ?param[0]=a&param[1]=b&param[2]=c). The underlying issue is PHP parsing $_GET['param'] as an array when square-bracket syntax is used, enabling injection ...