CVE-2025-15455

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery Request Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
bg5sbk	MiniCMS	1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8

References

https://github.com/ueh1013/VULN/issues/14Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.339488Permissions Required, VDB Entry
https://vuldb.com/?id.339488Third Party Advisory, VDB Entry
https://vuldb.com/?submit.725137Third Party Advisory, VDB Entry

Timeline

Published: Jan 5, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-154567.5A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php CVE-2025-154579.8A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of CVE-2025-154589.8A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the comp CVE-2025-154598.8A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/fo CVE-2025-15467.3A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this CVE-2025-154608.8A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formPptpClientConfig. Perform CVE-2025-154618.8A flaw has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/formTaskEdit. Executin CVE-2025-154628.8A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigAdvideo. The ma CVE-2025-154636.5The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and incl CVE-2025-154647.5Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security c CVE-2025-154665.4The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing c CVE-2025-154678.8Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer ov