CVE-2026-33398

NamelessMC is website software for Minecraft servers. In version 2.2.4, "modules/Forum/pages/forum/getquotes.php" only checks whether the caller is logged in, then reads a post by attacker-controlled "post" ID and returns its content. The backend helper in "modules/Forum/classes/Forum.php" does n...

NamelessMC security vulnerabilities

NamelessMC is a free, easy-to-use, and powerful website software developed by the NamelessMC team. It’s suitable for your Minecraft server and comes with numerous features. Version 2.2.4 of NamelessMC has a security vulnerability. This vulnerability arises from the getquotes.php script, which onl...

CVE-2026-33398: Improper Authorization

NamelessMC is website software for Minecraft servers. In version 2.2.4, modules/Forum/pages/forum/getquotes.php only checks whether the caller is logged in, then reads a post by attacker-controlled post ID and returns its content. The backend helper in modules/Forum/classes/Forum.php does not...