CVE-2026-35447
0.05%V4
2026-06-02
17h16 +00:00
17h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to write wall posts to private or blocking profiles. Additionally, the reply branch does not verify that the target wall post belongs to the current profile, enabling attackers to inject replies into arbitrary wall posts owned by other profiles via a restricted profile URL. This is patched in version 2.2.5.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Insertion of Sensitive Information Into Sent Data The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
EPSS
EPSS 是一种预测漏洞被利用可能性的评分模型。
EPSS 评分
EPSS 模型生成一个介于 0 到 1（即 0% 到 100%）之间的概率评分。评分越高，漏洞被利用的可能性越大。
EPSS 百分位
百分位用于根据 EPSS 评分对 CVE 进行排名。例如，EPSS 百分位为第 95 的 CVE，其被利用的可能性高于 95% 的其他 CVE。因此，百分位可用于比较不同 CVE 的 EPSS 评分。
