CVE-2025-30158CWE-400

NamelessMC Forum iframe width/height abuse causing UI-based Denial of Service

High · published April 18, 2025

CVSS v3.1
7.1
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements inside forum topics/comments/feed with no restriction on the iframe's width and height attributes. This allows an authenticated attacker to perform a UI-based denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This issue has been patched in version 2.2.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00557 · 45.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-04-18T15:50Z
EPSS history
Timeline
  • 18 APR 15:50Z
    NamelessMC Forum iframe width/height abuse causing UI-based Denial of Service
    cvelistv5