NamelessMC Nameless 2.2.4 Profile Page profile.php insertion of sensitive information into sent data

Summaryinfo

A vulnerability identified as problematic has been detected in NamelessMC Nameless 2.2.4. Impacted is an unknown function of the file modules/Core/pages/profile.php of the component Profile Page Handler. This manipulation causes insertion of sensitive information into sent data. The identification of this vulnerability is CVE-2026-35447. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in NamelessMC Nameless 2.2.4. It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the file modules/Core/pages/profile.php of the component Profile Page Handler. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. The CWE definition for the vulnerability is CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. As an impact it is known to affect confidentiality. The summary by CVE is:

NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to write wall posts to private or blocking profiles. Additionally, the reply branch does not verify that the target wall post belongs to the current profile, enabling attackers to inject replies into arbitrary wall posts owned by other profiles via a restricted profile URL. This is patched in version 2.2.5.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-35447 since 04/02/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

By approaching the search of inurl:modules/Core/pages/profile.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.2.4 or 2.2.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-33982). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• NamelessMC

Name

• Nameless

Version

• 2.2.4

Website

• Product: https://github.com/NamelessMC/Nameless/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion