NamelessMC Cross-Site Scripting Vulnerability Allowing JavaScript Execution on Staff Panel

A cross-site scripting (XSS) vulnerability has been identified in NamelessMC versions through 2.1.2. This issue allows users to inject JavaScript into an additional field, which is executed when a staff member views the user's profile in the staff panel. Consequently, an attacker could run JavaScript on the staff member's computer.

Impact

Exploitation of this vulnerability allows for the execution of JavaScript on the staff member's computer.

Reproduction

To reproduce this vulnerability, an admin must first enable the option for users to fill out additional fields. Once this is done, a user can inject a script, such as a JavaScript alert, into the new field. When a staff member with the appropriate permissions visits the user's profile, the injected script will execute.

Remediation

Users are advised to upgrade to NamelessMC version 2.1.3, where this vulnerability has been addressed.