How to fix CVE-2025-15456?

Within 7 days: Identify all affected systems running bg5sbk MiniCMS and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.

Is PHP affected by CVE-2025-15456?

Organizations using bg5sbk MiniCMS face moderate risk from CVE-2025-15456, a improper authentication vulnerability rated CVSS 7.3. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data.

CVE-2025-15456

HIGH

2026-01-05 [email protected]

PHP Minicms

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 16, 2026 - 21:35 vuln.today

Public exploit code

CVE Published

Jan 05, 2026 - 05:15 nvd

HIGH 7.3

DescriptionNVD

A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Publish Page Handler. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Publish Page Handler. [CVSS 7.3 HIGH]

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects Minicms. A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Publish Page Handler. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. The vendor was contacted early about this disclosure but did not respond in any way.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-15456 vulnerability details – vuln.today

Back