CVE-2025-32389

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Apr 18, 2025
Updated: May 13, 2025
CWE ID 89

Summary

CVE-2025-32389 is a vulnerability affecting NamelessMC, a popular website software for Minecraft servers. Prior to version 2.1.4, NamelessMC was susceptible to SQL injection due to an unconventional square bracket GET parameter syntax. PHP interprets this structure, such as `?param[0]=a&param[1]=b&param[2]=c`, as an array in `$_GET['param']`. Exploiting this weakness allowed attackers to inject malicious SQL queries, potentially leading to unauthorized access or data manipulation. This issue has been rectified in version 2.1.4.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share