How to fix CVE-2025-15458?

Within 7 days: Identify all affected systems running bg5sbk MiniCMS and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.

Is PHP affected by CVE-2025-15458?

Organizations using bg5sbk MiniCMS face moderate risk from CVE-2025-15458, a improper authentication vulnerability rated CVSS 7.3. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data.

CVE-2025-15458

HIGH

2026-01-05 [email protected]

PHP Minicms

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 15, 2026 - 20:30 vuln.today

Public exploit code

CVE Published

Jan 05, 2026 - 05:15 nvd

HIGH 7.3

DescriptionNVD

A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handler. Executing a manipulation can lead to improper authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handler. [CVSS 7.3 HIGH]

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects Minicms. A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handler. Executing a manipulation can lead to improper authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-15458 vulnerability details – vuln.today

Back