How to fix CVE-2025-15457?

Within 7 days: Identify all affected systems running bg5sbk MiniCMS and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.

Is PHP affected by CVE-2025-15457?

Organizations using bg5sbk MiniCMS face moderate risk from CVE-2025-15457, a improper authentication vulnerability rated CVSS 7.3. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data.

CVE-2025-15457

HIGH

2026-01-05 [email protected]

PHP Minicms

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 15, 2026 - 20:25 vuln.today

Public exploit code

CVE Published

Jan 05, 2026 - 05:15 nvd

HIGH 7.3

DescriptionNVD

A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Trash File Restore Handler. Performing a manipulation results in improper authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Trash File Restore Handler. [CVSS 7.3 HIGH]

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects Minicms. A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Trash File Restore Handler. Performing a manipulation results in improper authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-15457 vulnerability details – vuln.today

Back